Incident Response

Incident Response Policy

1. Purpose The purpose of this Incident Response Policy is to outline MFC Safe's framework for identifying, reporting, managing, and resolving security and service-related incidents to minimize impact on systems, data, and customer trust.

2. Scope This policy applies to all employees, contractors, systems, applications, networks, and third-party services used within the MFC Safe ecosystem, including the Didge platform, cloud services, and hardware endpoints.

3. Definitions

• Incident: Any actual or suspected event that could compromise the confidentiality, integrity, or availability of information systems, services, or data.

• Security Incident: Any breach or attempted breach of policies, systems, or security mechanisms.

• Service Incident: Disruptions in core services such as sensor reporting, platform downtime, gateway failures, or data anomalies.

4. Incident Categories & Severity

• Critical (Severity 1): Full system outages, data breaches, or regulatory implications.

• High (Severity 2): Partial system degradation affecting multiple users.

• Medium (Severity 3): Single-point issues with limited scope.

• Low (Severity 4): Minor anomalies or configuration concerns.

5. Incident Response Lifecycle

• 5.1 Detection & Notification:

  • Incidents may be detected via system monitoring, staff reports, client feedback, or automated alerts.

  • Reports must be immediately submitted via email, WhatsApp, direct call, or the online ticketing system.

• 5.2 Triage & Classification:

  • The Incident Response Team (IRT) classifies the incident severity and potential business impact.

  • Relevant stakeholders are notified within 30 minutes of confirmation.

• 5.3 Containment:

  • Short-term containment prevents further impact.

  • Long-term containment may involve temporary rerouting, patching, or isolation.

• 5.4 Eradication:

  • Root cause identification.

  • Removal of malicious actors or faulty components.

• 5.5 Recovery:

  • Restoration of services.

  • Validation of data integrity.

  • Monitoring for recurrence.

• 5.6 Post-Incident Review:

  • Documentation of the event.

  • Lessons learned.

  • Updates to response protocols.

6. Communication and Disclosure

• Internal escalation is immediate based on severity.

• Clients are notified of any incidents impacting service continuity or data integrity within 8 business hours.

• Regulatory disclosures are made in accordance with local data privacy and cybersecurity laws.

7. Roles & Responsibilities

• Incident Response Team (IRT): Coordinates incident response, communications, and documentation.

• IT & DevOps: Supports investigation and remediation.

• Management: Oversees major incidents and approves escalations.

8. Training & Testing

• Annual incident response training is mandatory for all technical staff.

• Tabletop exercises are conducted bi-annually.

9. Policy Review This policy is reviewed annually or after any major incident to ensure effectiveness and compliance.

Document Control

• Policy Owner: MFC Safe Security Operations

• Version: 1.0

• Last Reviewed: 02 April 2025

• Next Review: [+ 1 Year]