Disk Imaging: Create forensic images of affected systems for offline analysis.
Memory Forensics: Analyse system memory for evidence of malicious activity.
6.2 Chain of Custody A detailed chain of custody log will be maintained, documenting each person who handles the evidence, the date and time of transfer, and the purpose of the transfer. This ensures the admissibility of evidence in legal proceedings.
7. Communication Plan 7.1 Internal Communication Internal communication will be coordinated through the Incident Response Coordinator. Regular updates will be provided to the SOC team, IT Cloud, IT, and executive management.
7.2 External Communication External communication will be managed by the Communications Officer. Depending on the severity of the incident, communication may be directed to customers, regulatory bodies, and the public. Communication will be transparent, providing necessary information without compromising security.
7.3 Communication Templates Prepared communication templates will be used to ensure consistency and accuracy in messaging. These templates will be adapted based on the nature and severity of the incident.
8. Legal and Regulatory Compliance 8.1 Reporting Requirements In the event of a security incident, we are obligated to report certain incidents to regulatory bodies and authorities. For instance:
Data Breach Notification: In compliance with [applicable data protection laws], we will report any data breaches involving sensitive customer information to the [relevant data protection authority] within 72 hours of discovery.
8.2 Legal Support Contacts We have identified legal support contacts who specialize in cybersecurity and data protection. The Legal Advisor will coordinate with external legal counsel, to ensure that the organization follows legal protocols during and after a security incident.