This policy defines the process for identifying, managing, and responding to security incidents and data breaches within our systems and platforms. Its primary objectives are to:
This policy applies to all incidents affecting systems operated by the organisation, whether they originate internally or externally, and whether they are accidental or deliberate in nature.
This policy applies to all components of the organisation's technology environment, including:
Any person who becomes aware of a potential security incident — regardless of their role — is expected to report it immediately in accordance with this policy.
A security incident is any event that threatens the confidentiality, integrity, or availability of the organisation's systems or data. Incidents include but are not limited to:
Not every anomaly constitutes an incident. Unusual activity that does not meet the threshold of a confirmed or suspected breach may be logged as a security event and monitored without triggering the full incident response process. The Incident Response Lead makes this determination.
Clear ownership is essential to an effective incident response. The following roles are assigned for all incidents:
Coordinates the overall response, makes key decisions regarding containment and escalation, serves as the primary point of contact across teams, and ensures the incident is resolved and documented in a timely manner. In the absence of a designated lead, the most senior available team member assumes this role.
Investigates the incident, implements containment measures, identifies root causes, applies fixes and patches, and validates system integrity before returning services to production. The technical team is responsible for preserving all logs and forensic evidence throughout the process.
Assesses the legal and regulatory implications of the incident, determines whether breach notification obligations are triggered, and ensures the organisation's response aligns with applicable data protection laws and contractual commitments.
Manages all internal and external communications relating to the incident, including notifying affected users, drafting stakeholder updates, and preparing any required regulatory notifications. All external communications must be reviewed and approved before release.
The CTO holds ultimate responsibility for all actions required under this policy. This includes ensuring that the incident response framework is properly resourced and followed, that all team members with relevant responsibilities are trained and prepared, and that the organisation's technical security posture is continuously improved in light of incidents and emerging threats. The CTO is also responsible for ensuring this policy remains current at all times, commissioning reviews whenever circumstances require it, and approving all updates before they take effect.
All incidents are classified upon detection and reclassified if new information emerges during investigation.
Severity classifications directly determine the urgency of escalation, the personnel involved, and whether external notification is required.
Incidents may be detected through automated monitoring and alerting tools, reports from internal team members, user-submitted reports, third-party security disclosures, or routine system audits. Upon detection, the person who identifies the incident must immediately notify the Incident Response Lead and log the following:
Containment begins immediately upon confirmation that an incident is in progress. The technical team takes the following actions as appropriate to the nature of the incident:
Containment measures are documented in real time and must not destroy evidence required for subsequent investigation.
Once the incident is contained, the technical team conducts a structured investigation to determine:
All logs, system snapshots, and forensic evidence are preserved securely and must not be modified or deleted during or after the investigation.
Following investigation, the technical team implements the necessary remediation steps, which may include:
Before any affected system is returned to production, integrity validation must be completed to confirm that the threat has been fully eradicated and that restored data is accurate and complete.
Notification obligations are assessed by the Compliance and Management role. Internal stakeholders are notified immediately upon confirmation of a Critical or High severity incident. Affected users are notified as soon as practically possible when their personal data has been or may have been exposed, with clear information about:
Where applicable data protection regulations require notification to a supervisory authority or regulatory body — for example under GDPR within 72 hours of becoming aware of a breach — this obligation takes precedence and must be met within the required timeframe. All notifications are documented, including the date, content, and recipients.
Within five business days of incident resolution, the Incident Response Lead convenes a post-incident review meeting with all relevant team members. The review covers:
Outcomes from the review are used to update security controls, revise procedures, and inform staff training. All findings are recorded in the organisation's risk register.
Throughout the incident response process, the organisation is committed to handling all data — including evidence and logs — with the same care applied under normal operations:
A complete incident record must be created and maintained for every security incident, regardless of severity. Each record must include:
Incident records are stored securely, accessible only to authorised personnel, and retained in accordance with the organisation's data retention policy.
The organisation conducts periodic incident response exercises — including tabletop simulations and technical drills — to test the effectiveness of this policy and the readiness of the response team. These exercises are conducted at least once per year.
This policy is formally reviewed annually, or sooner following any of the following:
The review is led by the Compliance and Management role and approved by the CTO. The CTO holds ultimate ownership of this policy and is responsible for ensuring it is reviewed, updated, and enforced at all times — including outside of scheduled review cycles should operational, legal, or technical changes require it.
All incident handling activities must align with applicable legal and regulatory requirements, including but not limited to:
Non-compliance with this policy by any individual with system access may result in disciplinary action, suspension of access rights, or legal consequences depending on the nature and severity of the breach.
This policy is owned by the Chief Technology Officer (CTO), who is responsible for its maintenance, enforcement, and timely update. All team members with system access are required to familiarise themselves with its contents.