Appendix 1 Incident Response Plan ISO 22301

1. Purpose, scope, and users

The purpose of this Plan is to ensure the protection of the health and safety of people in the case of a disaster or other incident and to contain the incident. The objective is to reduce damage to the business to the smallest possible extent.

This Plan is applied to all major incidents threatening to disrupt any critical activity within the BCMS scope for a period longer than the recovery point objective for each individual activity (further in text: disruptive incidents).

Users of this document are all employees of Resolver.

2. Reference documents

• ISO 22301 standard, clauses 4.1, 4.3, 5.3, 6.2, and control 9.1.1
• ISO/IEC 27701:2019 standard clause 6.13

3. Authorizations and Responsibilities in incident response

4. Communication

The following table lists responsibilities for communication (sending as well as receiving information and responding to information requests) with various types of interested parties:

The communication procedure is as follows:

1. Any employee who receives a communication request or wants to initiate communication towards interested parties must forward such requests to a responsible person as indicated in the table above.
2. A responsible person, CTO & CISO, President, DPO, and CMO must agree with Legal Counsel on the content of the communication.
3. If the communication with external parties includes significant risks and impacts, the decision about such communication must be documented and formally approved by Legal Counsel and BC Coordinator (CTO & CISO) in conjunction with the PR Manager before such information is released.
4. After getting appropriate approval, the responsible person provides information to the interested party.

A responsible person from the above table is responsible for documenting each communication with any interested party.

5. Incident Categories

Incidents are categorized into the following:

1. IT incidents
2. Cybersecurity Incidents
3. Environmental Incidents

6. Cybersecurity Incidents Classification

Cybersecurity incidents are classified as follows:

1. Unauthorized Access.
2. Malware Infection.
3. Distributed Denial of Service (DDoS) Attack.
4. Internal Security Breaches and Insider Threats.
5. Security Misconfigurations.
6. Cryptography and Data Security.
7. Advanced Persistent Threats (APTs)

7. Procedures for disruptive incidents

7.1. Managing a disruptive incident

7.1.1 The obligation of every employee to report incidents

Every employee is obliged to report any disruptive incident in the following way:

• All incidents related to IT and communications technology are reported by e-mail to it@resolver.com or over the #infosys_announcements Slack channel or direct e-mail or Slack message or telephone to the Information Systems Director or IT Team members (Please consider your location and contact persons at your location)
• All other incidents are reported by e-mail to infosec@resolver.com or over the #infosec_announcements Slack channel, or direct e-mail or Slack message or telephone to the Information Security Analyst

Any other event or system vulnerability that has not yet developed into a disruptive incident must be reported in the same way.

If an incident requires the intervention of the police, ambulance, or fire service, the first available person must call 911 and notify thereof the responsible person in his/her organizational unit or the Crisis Manager.

In case an incident occurs, employees can freely communicate only with their relatives and the police, ambulance, or fire service, while all other communication is left to the Crisis Management Team.

7.1.2 Disruptive Incident Handling

The person who received information about the incident must assess whether the incident/potential incident is real or false, and if it is determined to be real, immediately activate this plan by taking the following steps:

• Start containing and eradicating the incident as described in the following sections of this document
• notify all responsible persons about the occurrence of the incident within their area of responsibility
• notify BC Coordinator, who must consider whether any of the interested parties need to be alerted
• monitor the status of an incident and, as necessary, inform the incident reporter and other employees involved in the incident about the progress of incident handling

In case a person is unable to contain and/or eradicate the incident, he/she must inform the Crisis Manager. The information that is forwarded to the Crisis Manager must include the nature and extent of a disruptive incident and its potential impact.

The person responsible for eradicating the incident must record all the actions taken into the Incident Log.

7.1.3 Crisis Manager

The Crisis Manager must monitor the progress of incident handling and the period of disruption of individual activities, and assess the time needed to solve the incident.

If the required time to solve the incident is longer than the recovery time objective of a particular activity, the recovery plan for the disrupted activity must be activated. In that case, the Crisis Manager must notify all recovery managers who will have to activate their recovery plans.

7.2. Containing and eradicating an incident

7.2.1 Evacuation of the building (regardless of incident type)

The building is evacuated to assembly points specified in the List of Business Continuity Sites, appended to the Business Continuity Plan.

7.2.2 Fire

The building is evacuated in accordance with the building evacuation plan.

 7.2.3 Interruption of power supply

7.3. Earthquake

The building is evacuated in accordance with the building evacuation plan.

7.4. Threat Letter

 7.5. Threat Call/ Bomb Threat

7.6. Telecommunications failure

7.7. Information system failure

7.8. Malicious code attack

7.9. Violation of internal or external rules

8. Managing records kept on the basis of this document

Only BC Coordinator, President, CISO can grant other employees access to the records.

9. Validity and document management

This document is valid as of August 2023.

This document, together with all additional materials, is stored in the following way:

• the paper form of the document is stored at the following locations: Command Centre, and all alternative sites for activities
• the electronic form of the document is stored in the following way: Box shared folder with limited access to Crisis Team Members only should be available to team members.

The owner of this document is an Information Security Analyst who must check and if necessary update the document at least once a year.

When evaluating the effectiveness and adequacy of this document, the following criteria need to be considered:

• number of incidents not covered by this document
• whether the steps described in this document are feasible in real situations
• incident response time

EFFECTIVE ON: August 2023

REVIEW CYCLE: Annual at least and as needed