Information Security Incident Handling Procedure

Company’s Information Systems are a potential target for external and / or internal security attacks. This fact implies that regardless of the security measures taken, it is likely that security incidents will occur.

A security incident is every violation or attempt for violation of the integrity, availability or confidentiality of Company’s information, which caused or could cause damage to the Company.

The objective of the Information Security Incident Handling Procedure is the determination of a specific incident handling direct procedure, in order the negative consequences to be reduced and the Company appropriate operation to be restored as soon as possible.

The definition of a specific incident handling procedure contributes to the comprehension of the main incident causes, in order the possibility of incident reoccurrence to be reduced and also makes feasible the periodic assessment and evaluation of the related risk and the incident handling methods effectiveness.

For each Company information system and application and generally in all cases where the Company’s information (printed or electronic) security may be compromised, a predefined and documented incident handling procedure must be in place. Standard incident handling procedures are published and modified by the Company Information Security Officer in cooperation with all involved Units.