Data Breach Incident Response Policy

Data Breach Incident Response Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

Safire, Inc. recognizes that cybersecurity and data privacy are critical considerations in today’s digital world. Safire understands that despite continued investments and best efforts to safeguard assets, client data may be the subject of a compromise. Safire is committed to responding quickly and decisively to any suspected or confirmed cybersecurity or data privacy incident, especially those involving client data (collectively an ‘Incident’).

Safire has crafted this Data Breach Incident Response Policy (this ‘Policy’) and the corresponding plan and worksheets to streamline decision-making and support those responding to an Incident.

Scope

This policy applies to any suspected or confirmed Incident involving information stored, processed, or transmitted (“handled”) by any Safire asset. This includes data in electronic or physical form, as well as assets managed on behalf of Safire by third parties.

Policy

Incident Response Team Members and Roles

For the purposes of a suspected or confirmed Incident, Safire has established the following roles. The Data Breach Incident Response Plan identifies the individuals within Safire who are assigned to those roles.

Internal Team Member Roles and Responsibilities

• The Oversight Group (Policy Authorities): Comprised of the CISO, Head of IT, and Compliance Officer.

• Responsibilities: Responsible for identifying and assessing security and compliance risk, coordinating with the Coordinator and Outside Counsel, and exercising executive escalation authority.

• Authority: Maintains ownership of the Incident Response controls. They provide oversight of the response but escalate to the CEO for final authority on decisions that materially impact business continuity.

• The Lead:

• Responsibilities: Responsible for executing the response strategy and making necessary operational decisions. This includes directing the messaging approach and authorizing tactical deviations from the Plan.

• Authority: The Lead acts as the operational commander during an event. However, the Lead must consult with and defer to the Oversight Group on matters involving regulatory, legal, or high-level security risks.

• The Alternate Lead:

• Responsibilities: Only involved in the Plan in the event the Lead is unavailable or incapacitated, in which case the Alternate Lead is authorized to act as the Lead.

• The Coordinator:

• Responsibilities: Responsible for managing the logistical efforts of the different parties involved in responding to an Incident and for facilitating the resolution of disputes between external team members.

• Requirements:

• Must ensure all Internal Team members have each other’s contact information (and External Team contacts) stored on at least one mobile device and in hard copy form outside Safire’s offices.

• Must routinely (no less than annually) review contacts and procedures to ensure consistency with current business processes.

• Constraint: The Coordinator’s procedures must not delay or impede the direct CEO escalation path utilized by the Oversight Group.

• Internal PR/Media: Coordinates messaging with media, regulators, and law enforcement in alignment with Outside Counsel.

External Team Member Roles and Responsibilities

• Outside Counsel: Engages and oversees external consultants (e.g., Forensics Vendor, PR/Media) under privilege, and determines third-party reporting needs (e.g., regulators, state Attorneys General).
• External PR/Crisis Communications Firm: Supports Safire in managing public perception and media inquiries.
• Forensics and Incident Response Vendor: Conducts forensic analysis, evidence preservation, and remediation.
• IT Vendor / Managed Security Services Vendor (MSSP): Responsible for the operational stability and security of Safire’s systems during an incident. This includes:
• Ensuring systems are backed up and restorable.
• Providing logs and alerts to the Forensics team.
• Executing containment and remediation tasks (e.g., patching, blocking IPs) as directed by The Lead.

Reporting and Responding to a Suspected or Confirmed Incident

Any suspected or confirmed Incident must immediately be reported to the Coordinator, with all Safire employees providing full cooperation. CISO/IT/Compliance may escalate directly to the CEO based on business impact severity. The Coordinator ensures prompt adherence to Data Breach Incident Response Procedures by identified persons/vendors, subject to CISO/IT/Compliance approval authority.

Communicating Outside the Safire about a Suspected or Confirmed Incident

Suspected or confirmed Incidents involve a number of legal and regulatory issues and must be handled appropriately. Therefore, the only persons authorized to speak with the media or others outside Safire about any suspected or confirmed Incident are:

• The External PR/Media contact (with approval from Oversight Group).
• The Lead (with approval from Oversight Group).
• The Oversight Group (CISO, Head of IT, Chief Compliance Officer) when engaging with regulators, law enforcement, or other official entities.

At no time are the Coordinator, Vendors, or general Safire employees permitted to speak with the media, post on social media, or discuss the incident with unauthorized parties.

Engaging External Team

The Coordinator, under the direction of the Oversight Group, will facilitate the engagement of the External Team prior to a breach so the members of the Incident Response Team are familiar with one another. Vendor selection and engagement terms require approval from the Oversight Group and Legal Counsel.

Procedures Testing

• Internal Testing: The Internal Team will meet at least annually to test the Plan using tabletop exercises. These exercises will validate the executive escalation pathway and decision-making authority framework.
• Plan Updates: The Coordinator will oversee updates to the Plan based on lessons learned during testing. All substantive plan updates require approval from the Oversight Group before implementation.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Data Breach Incident Response Plan
• NIST Special Publication 800-61 Rev 2 (Computer Security Incident Handling Guide)

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page