information has been exposed), each CSIRT member must be cleared through a background check process that would permit them that level of access. The CSIRT will consist of the following individuals or named representatives from the functional areas (which may include an external IT service provider): Chief Information Security Officer (CISO) [or equivalent manager over information security functions] & designated alternate Information Security Team primary & alternate – Network Operations primary & alternate – Data Center Operations primary & alternate – {{If applicable: Company’s Privacy Officer primary & alternate}} – {{If applicable: Company’s Risk Management Unit primary & alternate}} – {{If applicable: Website Management primary & alternate}} – {{If applicable: Applications Management (Development/Support) primary & – alternate}} {{If applicable: Database Administration primary & alternate}} – Internet Services Provider (ISP) primary & alternate (points of contact) – {{If applicable: Managed Security Services Provider (MSSP) primary & – alternate (points of contact)}} {{If applicable: Cloud Services Provider primary & alternate (points of – contact)}} Business Operations [division, department or functional workgroup] primary & – alternate {{repeat for each functional work area/group}} While not being direct members of the CSIRT, the following company functions should be consulted in advance of any incidents to determine and document necessary procedures, and must provide points of contact in case of an incident occurring. {{NOTE: Company may determine that any of these functions should actually be part of the CSIRT.}} These contacts should be able to address issues or concerns related to employees or potential liability matters resulting from a security incident, and to facilitate proper legal processes if matters need to be referred to law enforcement. Executive Management Human Resources Legal Counsel (company attorneys) Cybersecurity Insurance Carrier/Provider
information has been exposed), each CSIRT member must be cleared through a background check process that would permit them that level of access. The CSIRT will consist of the following individuals or named representatives from the functional areas (which may include an external IT service provider): Chief Information Security Officer (CISO) [or equivalent manager over information security functions] & designated alternate Information Security Team – primary & alternate Network Operations – primary & alternate Data Center Operations – primary & alternate {{If applicable: Company’s Privacy Officer – primary & alternate}} {{If applicable: Company’s Risk Management Unit – primary & alternate}} {{If applicable: Website Management – primary & alternate}} {{If applicable: Applications Management (Development/Support) – primary & alternate}} {{If applicable: Database Administration – primary & alternate}} Internet Services Provider (ISP) – primary & alternate (points of contact) {{If applicable: Managed Security Services Provider (MSSP) – primary & alternate (points of contact)}} {{If applicable: Cloud Services Provider – primary & alternate (points of contact)}} Business Operations [division, department or functional workgroup] – primary & alternate {{repeat for each functional work area/group}} While not being direct members of the CSIRT, the following company functions should be consulted in advance of any incidents to determine and document necessary procedures, and must provide points of contact in case of an incident occurring. {{NOTE: Company may determine that any of these functions should actually be part of the CSIRT.}} These contacts should be able to address issues or concerns related to employees or potential liability matters resulting from a security incident, and to facilitate proper legal processes if matters need to be referred to law enforcement. Executive Management Human Resources Legal Counsel (company attorneys) Cybersecurity Insurance Carrier/Provider
Computer_Security_Incident_Response_Plan_-_Comprehensive_Template_v08_2016-07-07_mogevu.docx