Information Security Incident Handling Policy

The purpose of the Information Security Incident Handling Policy is to develop a framework for timely and effective handling of information security incidents. An information security incident is a suspected or confirmed violation of the integrity, availability or confidentiality of the corporate information that could cause or has caused harm to Company.

The detection of potential information security incidents constitutes an action according to which it is timely identified and at the same time protects against real incidents intended to compromise the security of the Company.

Information security incidents are driven in most cases by intentional or inadvertent actions. Examples of such incidents include systems malfunction, interruption of IT Services provision, human errors, unauthorized access, unexpected results after changes to IT systems as well as breach or bypass of the in-place security controls. Prior to responding on such incidents either by directly restoring the affected IT systems to the latest stable condition or by investigating the incident itself (in terms of incident nature, extent, etc.), it is advisable to perform a risk assessment as well as a business impact assessment.