Incident Reporting or Notification Policy domain?

Question

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization.

e.g.

1. If a customer calls and says their data has been compromised and we're to blame
2. Someone receives unsolicited or suspicious e-mails from our domain.
3. Strange pop-up boxes on workstations
4. etc.

Note: We do not yet have a Incident Response Policy or Information Security Policy.

My question is should this type of document be a policy in its own right or a part of a larger Information Security policy or Incident Response Policy. I'm currently calling it a "Information Security Reporting Policy". Does this fall under an Information Security policy or Incident Response Policy or could it go either way or does it not matter as long as its written, clear, understood, and followed.

I wanted a simple, one page document that could be gone over with users through new hire training or by H.R..

Basically it states...

1. Document type of problem and description
2. Who reported? Ask for contact information (name, phone, e-mail) and consent to being contacted by security personal or management
3. Document date and time of occurrence
4. If applicable to situation ask for OS, browser, A/V, use of firewalls, use of wireless network etc.
5. How and whom to report to(escalate)

Should anything else be mentioned, removed, or modified? Does this sound reasonable, what are you thoughts?

Thanks Jon

Answer 1

You're describing a procedures (i.e. "how do do X"), not a policy ("Do X"). As such the name of the procedure doesn't really matter. What matters is that it references and is supported by one or more higher level policies.

An information security policy should cover far more than what you've described; I would be very hesitant to title your procedure "Information Security Policy" - that would be like labelling the keyboard "My computer". The example is intentionally overstated, but if your company were audited and the auditors found your one-pager as the only document labelled "Information Security Policy", then you would have implicitly authorized all actions not covered by that policy. (I don't know if your company is subject to audits. You've included a pci tag which leads me to believe that it is a possibility).

Generally the information security policy includes incident response policy. Procedures are written to implement the policies.

Answer 2

By calling it Incident Responce Policy you give it more weight. Wherever possible automate the process of background data collection (date/time, OS etc.) if you're planning to use it internally.

If I understand you correctly the document handles both client and workplace incidents. Shouldn't the two be separate? Then one could be a policy and the other part of a policy.

Both titles are good. Information Security Policy would be better suited for an internal document while Incident Responce suits client-oriented policies. But it doesn't matter one bit as long as it's properly followed and understood (and periodicaly reminded of it).