Data Security Incident Response Plans — Some Practical Suggestions

A comprehensive and suitable data security incident response plan and a trained incident response team are fundamental parts of an enterprise risk management program. Nevertheless, recent surveys indicate that most organizations either do not have a suitable data security incident response plan or have not implemented an appropriate testing, training and exercise program. This bulletin provides some practical suggestions for creating and implementing a data security incident response plan.

Data Security Incident Response Plans

(a) Overview

A data security incident response plan (an "IRP") is a written plan, comprised of instructions, procedures, protocols and guidelines, designed to enable an organization to respond to, and recover from, various kinds of data security incidents in a way that minimizes resulting harm, reduces recovery time and costs and allows the organization to benefit from lessons learned.