Purpose
Provide a controlled method to assess disruptions, activate continuity arrangements and communicate with internal and external stakeholders.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Record the disruption | Initial facts, affected services, immediate safety/security concerns | Incident log |
| 2 | Assess activation criteria | Thresholds for declaring incidents (system outage, breach, natural disaster) | Activation decision |
| 3 | Convene Incident Response Team | Defined leads in IT, compliance, operations, communications; assign incident leadership, operations, technology, compliance, communications, recordkeeping roles | IRT assignments |
| 4 | Activate continuity plans | Applicable continuity/recovery plans; track decisions, actions, service status, recovery objectives | Action and decision log |
| 5 | Follow escalation procedures | Pathways from departmental to Board-level; escalate material incidents to management and Board | Escalation record |
| 6 | Meet regulatory obligations | Immediate notification to CBCS per local requirements; maintain notification evidence | CBCS notification |
| 7 | Communicate via authorized channels | Designated spokesperson (Communications Officer); Internal: secure chat, call trees, SMS, email; External: customer notifications, regulator reporting, media; Alternate: satellite phones, radios, WhatsApp/Teams | Communication log |
| 8 | Close response and review | After stabilization, handover, documented approval; initiate lessons learned and corrective actions | Closure approval |
Exceptions and Escalation
When normal communication channels are unavailable, use documented alternate channels and call trees. Uncertainty about regulatory notification shall be escalated immediately to Compliance.
Records
- Incident log and activation decision
- Incident response team assignments
- Action, decision and communication logs
- Board and CBCS notifications
- Recovery status and closure approval
Relationships
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-BCM-005 Ensure Incident Response and Communications Are Activated and Tested
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: per incident; call trees tested quarterly
History
- 2026-07-26: Created from sections 10 and 11 of the approved Business Continuity Manual.