Security Incident Management, E-Discovery, & Cloud Forensics Policy

1. Service Management Policy and Procedures:

1.1 Vendor Selection Criteria:

1.1.1 Security Integration:

Vendors must integrate security practices into their service management approach, aligning with Uhubs's security requirements (e.g. ISO / SOC, Industry Leader, GDPR Compliant).

1.1.2 Comprehensive SLAs:

Establish SLAs with vendors, emphasizing incident response commitments, transparency, and collaboration during security incidents.

2. Incident Response Plans:

2.1 Incident Response Plan:

Follow the Incident Response plan outlined in the Governance, Risk and Compliance Policy.

3. Incident Response Testing:

3.1 Regular Simulation Exercises for Team to Discuss:

3.1.1 Scenario 1 - Cloud Service Disruption:

Simulate a cloud service disruption to evaluate the effectiveness of incident response procedures specific to cloud environments.

3.1.2 Scenario 2 - Data Exfiltration:

Test the response to a simulated data exfiltration incident, focusing on detection, containment, and communication in cloud-based scenarios.

3.1.3 Scenario 3 - Vendor Security Incident:

Simulate a security incident involving a vendor, assessing coordination, communication, and resolution processes.

4. Incident Response Metrics:

4.1 Key Performance Indicators (KPIs):

4.1.1 Cloud Incident Resolution Time:

Measure the average time taken to resolve security incidents within cloud environments.

4.1.2 E-Discovery Response Rate:

Track the efficiency of Uhubs's response to e-discovery requests, ensuring timely and accurate information retrieval.

4.1.3 Vendor Incident Resolution Efficiency:

Evaluate the effectiveness of incident response efforts when collaborating with vendors.

5. Event Triage Processes:

5.1 Low Concern (1):

• Description: Incidents categorized as low concern have minimal impact on operations and data integrity.
• Response Time: Addressed with routine procedures within standard timeframes.
• Examples: Routine software glitches, minor system disruptions with limited impact.

5.2 Moderate Concern (2):

• Description: Incidents of moderate concern indicate a noticeable impact on certain systems or processes but are manageable.
• Response Time: Addressed promptly within an accelerated timeframe.
• Examples: Temporary service disruptions, isolated data inconsistencies.

5.3 Elevated Concern (3):

• Description: Incidents categorized as elevated concern pose a significant risk to specific systems or processes and require immediate attention.
• Response Time: Urgent response within a short timeframe.
• Examples: Breaches with limited scope, potential exposure of sensitive information.

5.4 High Concern (4):

• Description: High concern incidents signify a critical threat with the potential for widespread impact on operations and data security.
• Response Time: Immediate and urgent response required.
• Examples: Advanced persistent threats, significant data breaches.

5.5 Critical Concern (5):

• Description: Critical concern incidents represent an imminent and severe threat, with the potential for catastrophic consequences if not addressed urgently.
• Response Time: Immediate and top-priority response mandated.
• Examples: Large-scale system compromise, existential threats to data integrity or security.

5.5.1 Criteria 1 - Cloud Impact:

Triage events based on their impact on cloud services, prioritizing incidents affecting critical infrastructure.

5.5.2 Criteria 2 - E-Discovery Priority:

Prioritize e-discovery requests based on legal requirements, ensuring compliance with timelines and accuracy.

5.5.3 Criteria 3 - Vendor Involvement:

Establish criteria for identifying incidents requiring vendor collaboration, streamlining coordination efforts.

6. Security Breach Notification:

6.1 Timely Reporting:

6.1.1 Vendor Notification Protocol:

Establish protocols for notifying vendors in the event of a security breach, emphasizing timely and transparent communication.

• Where a breach affects a vendor or sub-processor directly or indirectly, Uhubs notifies that vendor promptly and, in any event, within 72 hours of detection.

This vendor timeframe is separate from, and does not limit, the customer notification commitment in section 6.2.

6.1.2 E-Discovery Reporting Process:

Define procedures for reporting e-discovery findings, adhering to legal requirements and maintaining transparency.

6.2 Customer Notification:

Uhubs notifies affected customers in writing without undue delay after becoming aware of any actual or suspected security breach, unauthorised access, or loss of data affecting the Platform or customer data held within it, and in any event within the timeframe agreed in the applicable data processing agreement or contract.

The first notice covers what is known at the time. Uhubs does not wait for a complete picture before notifying.

7. Points of Contact Maintenance:

7.1 Regular Updates:

7.1.1 Vendor Contact Review:

Conduct regular reviews of vendor points of contact, ensuring accurate information for incident reporting and coordination.

7.1.2 Legal and E-Discovery Contacts:

Maintain up-to-date information for legal contacts and e-discovery points of contact to facilitate efficient communication and compliance.

8. Regular Policy Review and Updates:

Uhubs places a strong emphasis on the regular review and update of the policy. An annual review process will be in place to assess the plan's alignment with the evolving environment. This commitment ensures that the policy remains current, adaptable, and effective in addressing emerging challenges and maintaining adherence.

‍