ExportableProof — Routines today. Proof tomorrow.

Policy

Incident Management Policy

This document is Arcfield's Incident Management Policy, document ID INC-MGT-POL-001. It binds how Arcfield reports, classifies, owns, preserves evidence for, and learns from information-security incidents. Response playbooks live in IRP and IRPROC. It is not the ISMS Scope Statement, the Risk Assessment Methodology or the Statement of Applicability. It applies to Arcfield Platform production, customer data, CI/CD, privileged access and critical suppliers. Neighbouring records cite this Document Control version. Do not copy these paragraphs into those records.

This file is a fictional Arcfield example, not your organization's approved policy. Copy this file as the controlled Word master for your ISMS only after you replace Arcfield decisions with your own.

Back to demo

Demo. This is an Arcfield simulation, not a customer record. Provided as-is, without warranty. It does not replace professional legal, audit, or certification advice.

OSCAL source · IMP

{
  "artifactId": "IMP",
  "iso": [
    "A.5.24",
    "A.5.25",
    "A.5.26",
    "A.5.27",
    "A.5.28"
  ],
  "catalog": [
    {
      "iso": "A.5.24",
      "oscalId": "iso27001-a.5.24",
      "title": "Information security incident management planning and preparation",
      "className": "iso27001-annex-a",
      "group": "Organizational controls (Annex A.5)"
    },
    {
      "iso": "A.5.25",
      "oscalId": "iso27001-a.5.25",
      "title": "Assessment and decision on information security events",
      "className": "iso27001-annex-a",
      "group": "Organizational controls (Annex A.5)"
    },
    {
      "iso": "A.5.26",
      "oscalId": "iso27001-a.5.26",
      "title": "Response to information security incidents",
      "className": "iso27001-annex-a",
      "group": "Organizational controls (Annex A.5)"
    },
    {
      "iso": "A.5.27",
      "oscalId": "iso27001-a.5.27",
      "title": "Learning from information security incidents",
      "className": "iso27001-annex-a",
      "group": "Organizational controls (Annex A.5)"
    },
    {
      "iso": "A.5.28",
      "oscalId": "iso27001-a.5.28",
      "title": "Collection of evidence",
      "className": "iso27001-annex-a",
      "group": "Organizational controls (Annex A.5)"
    }
  ],
  "profileAlters": [
    {
      "control-id": "iso27001-a.5.24",
      "adds": [
        {
          "props": [
            {
              "name": "applicability",
              "value": "applicable"
            },
            {
              "name": "applicability-justification",
              "value": "Required for incident readiness."
            },
            {
              "name": "implementation-status",
              "value": "Implemented"
            }
          ]
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.25",
      "adds": [
        {
          "props": [
            {
              "name": "applicability",
              "value": "applicable"
            },
            {
              "name": "applicability-justification",
              "value": "Required for event triage."
            },
            {
              "name": "implementation-status",
              "value": "Implemented"
            }
          ]
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.26",
      "adds": [
        {
          "props": [
            {
              "name": "applicability",
              "value": "applicable"
            },
            {
              "name": "applicability-justification",
              "value": "Required for incident handling."
            },
            {
              "name": "implementation-status",
              "value": "Implemented"
            }
          ]
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.27",
      "adds": [
        {
          "props": [
            {
              "name": "applicability",
              "value": "applicable"
            },
            {
              "name": "applicability-justification",
              "value": "Required for improvement after incidents."
            },
            {
              "name": "implementation-status",
              "value": "Planned"
            }
          ]
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.28",
      "adds": [
        {
          "props": [
            {
              "name": "applicability",
              "value": "applicable"
            },
            {
              "name": "applicability-justification",
              "value": "Required for audit and incident evidence."
            },
            {
              "name": "implementation-status",
              "value": "Implemented"
            }
          ]
        }
      ]
    }
  ],
  "components": [
    {
      "uuid": "1d98c15f-f209-5732-b2a2-afbdde298d44",
      "type": "policy",
      "title": "Arcfield Incident Management Policy (SIMULATION)",
      "purpose": "Define incident reporting, classification, escalation, response governance and lessons learned.",
      "props": [
        {
          "name": "simulation",
          "value": "true"
        },
        {
          "name": "artifact-id",
          "value": "IMP"
        },
        {
          "name": "object-type",
          "value": "policy"
        },
        {
          "name": "comparison",
          "value": "a"
        },
        {
          "name": "pack-role",
          "value": "in-pack"
        },
        {
          "name": "implemented-requirement-count",
          "value": "5"
        },
        {
          "name": "volumes",
          "value": "2,3,4"
        },
        {
          "name": "unresolved-cites",
          "value": "SINV"
        }
      ]
    }
  ],
  "sspImplementedRequirements": [
    {
      "control-id": "iso27001-a.5.24",
      "props": [
        {
          "name": "iso-id",
          "value": "A.5.24"
        },
        {
          "name": "applicability",
          "value": "applicable"
        },
        {
          "name": "evidence-layer",
          "value": "linked"
        },
        {
          "name": "implementation-status-raw",
          "value": "Implemented"
        },
        {
          "name": "control-owner",
          "value": "Incident Manager"
        },
        {
          "name": "evidence-status",
          "value": "Complete"
        },
        {
          "name": "unresolved-evidence",
          "value": "IRP"
        }
      ],
      "links": [
        {
          "rel": "cites",
          "text": "SOA"
        },
        {
          "rel": "cites",
          "text": "ISOCTRL"
        },
        {
          "rel": "cites",
          "text": "IMP"
        },
        {
          "rel": "cites",
          "text": "MDR"
        },
        {
          "rel": "cites",
          "text": "DR"
        },
        {
          "rel": "cites",
          "text": "RRS"
        },
        {
          "rel": "cites",
          "text": "AI"
        },
        {
          "rel": "cites",
          "text": "UAI"
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.25",
      "props": [
        {
          "name": "iso-id",
          "value": "A.5.25"
        },
        {
          "name": "applicability",
          "value": "applicable"
        },
        {
          "name": "evidence-layer",
          "value": "linked"
        },
        {
          "name": "implementation-status-raw",
          "value": "Implemented"
        },
        {
          "name": "control-owner",
          "value": "Incident Manager"
        },
        {
          "name": "evidence-status",
          "value": "Partial"
        },
        {
          "name": "unresolved-evidence",
          "value": "SIR"
        }
      ],
      "links": [
        {
          "rel": "cites",
          "text": "SOA"
        },
        {
          "rel": "cites",
          "text": "ISOCTRL"
        },
        {
          "rel": "cites",
          "text": "IMP"
        },
        {
          "rel": "cites",
          "text": "MDR"
        },
        {
          "rel": "cites",
          "text": "DR"
        },
        {
          "rel": "cites",
          "text": "RRS"
        },
        {
          "rel": "cites",
          "text": "AI"
        },
        {
          "rel": "cites",
          "text": "UAI"
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.26",
      "props": [
        {
          "name": "iso-id",
          "value": "A.5.26"
        },
        {
          "name": "applicability",
          "value": "applicable"
        },
        {
          "name": "evidence-layer",
          "value": "linked"
        },
        {
          "name": "implementation-status-raw",
          "value": "Implemented"
        },
        {
          "name": "control-owner",
          "value": "Incident Manager"
        },
        {
          "name": "evidence-status",
          "value": "Partial"
        },
        {
          "name": "unresolved-evidence",
          "value": "IR-RB"
        }
      ],
      "links": [
        {
          "rel": "cites",
          "text": "SOA"
        },
        {
          "rel": "cites",
          "text": "ISOCTRL"
        },
        {
          "rel": "cites",
          "text": "IMP"
        },
        {
          "rel": "cites",
          "text": "MDR"
        },
        {
          "rel": "cites",
          "text": "DR"
        },
        {
          "rel": "cites",
          "text": "RRS"
        },
        {
          "rel": "cites",
          "text": "AI"
        },
        {
          "rel": "cites",
          "text": "UAI"
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.27",
      "props": [
        {
          "name": "iso-id",
          "value": "A.5.27"
        },
        {
          "name": "applicability",
          "value": "applicable"
        },
        {
          "name": "evidence-layer",
          "value": "linked"
        },
        {
          "name": "implementation-status-raw",
          "value": "Planned"
        },
        {
          "name": "control-owner",
          "value": "Incident Manager"
        },
        {
          "name": "evidence-status",
          "value": "Partial"
        }
      ],
      "links": [
        {
          "rel": "field-ref",
          "text": "CIL"
        },
        {
          "rel": "cites",
          "text": "SOA"
        },
        {
          "rel": "cites",
          "text": "ISOCTRL"
        },
        {
          "rel": "cites",
          "text": "IMP"
        },
        {
          "rel": "cites",
          "text": "MDR"
        },
        {
          "rel": "cites",
          "text": "DR"
        },
        {
          "rel": "cites",
          "text": "RRS"
        },
        {
          "rel": "cites",
          "text": "AI"
        },
        {
          "rel": "cites",
          "text": "UAI"
        }
      ]
    },
    {
      "control-id": "iso27001-a.5.28",
      "props": [
        {
          "name": "iso-id",
          "value": "A.5.28"
        },
        {
          "name": "applicability",
          "value": "applicable"
        },
        {
          "name": "evidence-layer",
          "value": "linked"
        },
        {
          "name": "implementation-status-raw",
          "value": "Implemented"
        },
        {
          "name": "control-owner",
          "value": "ISMS Manager"
        },
        {
          "name": "evidence-status",
          "value": "Complete"
        }
      ],
      "links": [
        {
          "rel": "field-ref",
          "text": "ELAI"
        },
        {
          "rel": "cites",
          "text": "SOA"
        },
        {
          "rel": "cites",
          "text": "ISOCTRL"
        },
        {
          "rel": "cites",
          "text": "IMP"
        },
        {
          "rel": "cites",
          "text": "MDR"
        },
        {
          "rel": "cites",
          "text": "DR"
        },
        {
          "rel": "cites",
          "text": "RRS"
        },
        {
          "rel": "cites",
          "text": "AI"
        },
        {
          "rel": "cites",
          "text": "UAI"
        }
      ]
    }
  ]
}

Check installation

What is installed here. Extra volumes are optional and do not change Ready. Update re-runs the check.

CheckResult
Webserver…
Python…
Volumes…
Scripts…
Ready…
Working directory…
Last update…