Incident Response

Incident Response Policy

Breach means the acquisition, access, use, or disclosure of personally identifiable information (PII) or sensitive company data such as email, employee information, confidential information, etc. which compromises the security or privacy of the PII or sensitive company data.

Unsecured PII means PII that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals using a technology or methodology such as encryption. The definition of unsecured PII varies between different federal and regulations.

1. Reporting and Response: Company will ensure that all incidents, threats, or violations that affect or may affect the privacy, confidentiality, integrity, or availability of PII and sensitive company data will be reported and responded to promptly.
2. Security Incident Response Team (SIRT): Company shall have a SIRT charged with the responsibility of identifying, evaluating and responding to security incidents. The Privacy Security Officer shall oversee the activities of the SIRT.
3. Employee Training: Company will record and ensure that all employees annually acknowledge company policies and receive training on data breach including how to identify and report security incidents.
4. Breach Determination: SIRT will investigate all reported and suspected security breaches with referral to federal or state regulations to help with breach determination.
5. Breach Notification: If the SIRT determines that a breach of unsecured PII has occurred, breach notification of affected individuals may be required.
6. Date of Discovery: Usually a breach will be treated as discovered as of the first day the breach is known or by exercising reasonable diligence would have been known.
7. Timeliness of Notification: Company will provide the required notifications without unreasonable delay after discovery of a breach.
8. Content of Notification: A brief description in plain language of what happened (including date of known breach and discovery), type of unsecured PII involved, steps to protect individuals from potential harm, company investigation and mitigation, and contact procedures for individuals to ask questions.
9. Written Notice: Written notification by first-class mail to the individual at the last known address of the individual or, via e-mail if the individual agrees to e-mail notice.
10. Substitute Notice: A substitute notification including a contact phone number usually in the form of either a conspicuous posting on the company website home page, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside.
11. Media Notification: In addition to notifying individuals of a known breach, a notification to the media may be required as well.
12. Federal or State Notification: Company may need to report breaches of unsecured information to federal or state regulatory agencies.
13. Third Party Service Provider Notification: Third Party Service Provider responsible for a breach of company PII or sensitive company data should be required to notify the company within a pre-determined reasonable timeframe defined in a Service Provider Agreement.

Incident Response Plan

A security incident at Matrixforce is a violation or imminent threat of computer security policies, acceptable use policies, or standard security practices.

Reports of computer incidents should include a description of the incident or event, using the appropriate taxonomy, and as much of the following information as possible; however, reporting should not be delayed for additional information:

• Contact information for both the impacted and reporting organizations (unless submitting an anonymous report)
• Details describing any vulnerabilities involved (i.e., Common Vulnerabilities and Exposures (CVE) identifiers)
• Date/Time including time zone of occurrence, detection, and identification
• Related indicators (e.g. hostnames, domain names, network traffic characteristics, registry keys, X.509 certificates, MD5 file signatures)
• Threat vectors, if known (unknown, attrition, web, e-mail, removable media, spoofing, improper use, other)
• Prioritization factors (i.e. functional impact, information impact, and recoverability)
• Source and Destination Internet Protocol (IP) address, port, and protocol
• Operating System(s) affected
• Mitigating factors (e.g. full disk encryption or two-factor authentication)
• Mitigation actions taken, if applicable
• System Function(s) (e.g. web server, domain controller, or workstation)
• Physical system location(s) (e.g. Tulsa, Oklahoma City)
• Sources, methods, or tools used to identify the incident (e.g. Intrusion Detection System or audit log analysis)

Notification of a computer security incident to supervisor or Security Officer is mandatory when the confidentiality, integrity, or availability of a regulated information system has been confirmed to be compromised.

It is imperative for reporting to adhere to the one-hour timeframe and provide all available information. Do not delay reporting in order to provide further details (i.e. root cause, vulnerabilities exploited, or mitigation actions taken) as this may result in high risk to the system or enterprise. If the cause of the incident is later identified, the threat vector may be updated in a follow-up report.