I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization.
- If a customer calls and says their data has been compromised and we're to blame
- Someone receives unsolicited or suspicious e-mails from our domain.
- Strange pop-up boxes on workstations
Note: We do not yet have a Incident Response Policy or Information Security Policy.
My question is should this type of document be a policy in its own right or a part of a larger Information Security policy or Incident Response Policy. I'm currently calling it a "Information Security Reporting Policy". Does this fall under an Information Security policy or Incident Response Policy or could it go either way or does it not matter as long as its written, clear, understood, and followed.
I wanted a simple, one page document that could be gone over with users through new hire training or by H.R..
Basically it states...
- Document type of problem and description
- Who reported? Ask for contact information (name, phone, e-mail) and consent to being contacted by security personal or management
- Document date and time of occurrence
- If applicable to situation ask for OS, browser, A/V, use of firewalls, use of wireless network etc.
- How and whom to report to(escalate)
Should anything else be mentioned, removed, or modified? Does this sound reasonable, what are you thoughts?