Purpose
This policy defines Carriyo's approach to managing information security incidents. It ensures that incidents are identified quickly, managed effectively, and that lessons learned are used to improve our security posture.
Scope
This policy covers all information security incidents affecting Carriyo systems, data, or operations, regardless of whether they originate internally or externally.
Incident Classification
Severity Levels
Critical (P1)
- Active data breach involving customer PII
- Complete platform outage
- Ransomware or destructive malware infection
- Response time: immediate (within 15 minutes)
High (P2)
- Partial service degradation affecting multiple customers
- Unauthorized access to internal systems
- Successful phishing attack with credential compromise
- Response time: within 1 hour
Medium (P3)
- Failed intrusion attempt with evidence of targeted activity
- Vulnerability discovery in production systems
- Single-customer service impact
- Response time: within 4 hours
Low (P4)
- Routine security alerts from monitoring systems
- Minor policy violations
- Informational security events
- Response time: within 24 hours
Incident Response Process
1. Detection and Reporting
- Security events are detected through automated monitoring, alerting systems, and employee reports
- Any employee who identifies a potential security incident must report it immediately to the security team
2. Triage and Classification
- The security team assesses the incident to determine its severity, scope, and potential impact
- An incident commander is assigned for P1 and P2 incidents
3. Containment
- Immediate actions are taken to prevent further damage or data loss
- Affected systems may be isolated from the network
- Compromised credentials are immediately revoked
4. Eradication and Recovery
- The root cause is identified and eliminated
- Affected systems are restored from known-good backups
- Security patches or configuration changes are applied
5. Post-Incident Review
- A post-incident review is conducted within 5 business days of resolution
- Root cause analysis and lessons learned are documented
- Preventive measures are identified and tracked to implementation
Communication
- Affected customers are notified according to contractual obligations and regulatory requirements
- Internal stakeholders are updated through regular status communications during active incidents
- Post-incident reports are shared with relevant parties
Documentation
All incidents are documented in our incident management system, including timeline, actions taken, impact assessment, and lessons learned.