IRP-04ISO/IEC 27001:2022 A.5.24, A.5.25, A.5.26, A.5.27, A.5.28SOC 2 CC7.3, CC7.4
Incident Management & 72-Hour Breach Notification Plan Template
Standard Operating Procedure for rapid incident classification, containment, evidence preservation, and GDPR Article 33 72-hour client breach notifications.
Mandatory Controls Enforced in This Policy
P1 to P4 Incident Classification Matrix with explicit target response (<15m) and resolution SLAs
6-Phase Incident Response Lifecycle: Identification, Triage, Investigation, Eradication, Recovery, Post-Mortem
Mandatory GDPR Article 33 Client & Regulatory Breach Notification SLA within 72 hours
Tamper-evident forensic evidence retention and 5-day post-mortem RCA commitment
incident-management-breach-notification-plan-72h.md
LIVE ISMS SPEC
# Incident Management & Breach Notification Plan (IRP-04)
**Classification:** Internal / Client-Accessible
**Controls Mapped:** ISO/IEC 27001:2022 A.5.24-A.5.28 | SOC 2 CC7.3, CC7.4 | GDPR Art. 33
---
## 1. Objective
Establish a structured procedure to identify, contain, mitigate, and report information security incidents while satisfying GDPR Article 33 and client contractual notification obligations.
## 2. Severity Classification Matrix
- **P1 (Critical):** Confirmed data breach or ransomware. Target Response: < 15 min | Target Resolution: < 4 hours.
- **P2 (High):** Workstation compromise or elevated unauthorized access. Target Response: < 1 hour.
- **P3 (Medium):** Phishing attempt or staging vulnerability. Target Response: < 4 hours.
- **P4 (Low):** Minor policy deviation. Target Response: < 24 hours.
## 3. Client & Regulatory Breach Notification (72-Hour SLA)
In the event of a confirmed personal data or client confidential breach, the Security Lead will notify affected clients in writing without undue delay, and in no event later than **72 hours** after confirmation.
This is 1 of 18 policies compiled dynamically in LeanSec Studio.Open Full Studio Editor
Auditor Evidence Checklist for IRP-04
Audit-ReadyWhen an ISO 27001 or SOC 2 auditor reviews this policy, they will ask for the following artifacts:
Documented incident response workflow with designated Incident Lead
Tested tabletop drill records conducted in the past 12 months
Template breach notification letters adhering to GDPR Article 33
Frequently Asked Questions
What is the penalty for failing the GDPR 72-hour breach SLA?
GDPR Article 83 fines for failure to report breaches within 72 hours can reach up to €10,000,000 or 2% of annual global turnover, plus contractual liabilities.