16.1 Management of information security incidents and improvements
Objective : To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses.
16.1.1 Responsibilities and procedures
365Talents has defined procedures to manage security incidents :
- monitoring, detecting, analyzing and reporting of information security events and incidents
- logging incident management activities
- assessment of and decision on information security events
These procedures ensure that competent personnel handle the issues related to information security incidents within 365Talents and that a point of contact for security incidents' detection and reporting is implemented. These procedures includes too actions to be undertaken in case of security event e.g. noting all details immediately and taking only coordinated actions.
Roles and responsibilities are defined between the IT Security Manager, the CTO, the Head of Engineering, the Clients Support team and the Technical Support team of 365Talents regarding the management of information security events and incidents.
16.1.2 Reporting information security events
All employees and contractors of 365Talents are made aware of their responsibility to report information security events as quickly as possible and of the procedure for reporting information security events and the point of contact to which the events should be reported.
The security point of contact identified within the Client's organization is immediately informed in case of security events impacting it.
16.1.3 Reporting information security weaknesses
All employees and contractors are required to note and report any observed or suspected information security weaknesses in systems or services, as quickly as possible to an identified point of contact to prevent information security incidents. The reporting mechanism is easy, accessible and available (dedicated internal communication channel available to all employees and contractors).
The security point of contact identified within the Client's organization is immediately informed in case of security weakness impacting it.
16.1.4 Assessment of and decision on information security events
Information security events are assessed by the IT Security manager and the CTO and/or the Head of engineering to decide if they are to be classified as information security incidents.
Results of the assessment and decision are recorded.
Security incidents impacting Clients are prioritized and stop any other development and deployment for the platform until resolution.
16.1.5 Response to information security incidents
Information security incidents are responded to by a nominated point of contact and other relevant persons of 365Talents.
The response include the following :
- Collecting evidence as soon as possible after the occurence,
- escalation if required,
- ensuring that all involved response activities are properly logged for later analysis,
- communicate the existence of the information security incident or any relevant details thereof to other internal and external people or organizations (including impacted Clients) with need-to-know,
- dealing with information security weakness(es) found to cause or contribute to the incident,
- once the incident has been successfully dealt with, formally closing and recording it.
In case of incident not solved by the Clients Support team, an escalation is performed to the Technical Support to take in charge the management of the incident. As soon as the incident is identified and confirmed, the Clients Support team informs the Client and determine in accordance with the Client a severity level and an estimation of the resolution time. If the resolution of the incident requires a modification of the Service, the good practices of development (tests, initial deployment in pre-production, ...) are followed. Then the Clients Support team informs the Client of the resolution of the incident.
In case of immediate threat, emergency actions are taken accordingly to the emergency change management procedures.
16.1.6 Learning from information security incidents
If any information security incident may occur, lessons from it would be learned to improve security process and measures in order to reduce the likelihood and impact of future incidents and identify recurring or high impact incidents.
16.1.7 Collection of evidence
365Talents hasn't deployed a process to perform forensic analysis and ensure chain of custody in case of incident but is able otherwise to guarantee safety of evidences and is able to collect and preserve evidences (logs) when needed.