Incident Response Policy

1 · Purpose

This policy ensures that information security incidents are detected, reported, contained and resolved quickly and consistently, and that affected parties and regulators are notified where required.

2 · Scope

Applies to all security incidents and suspected incidents affecting Nxt7a information, systems or services, and to everyone who may detect or be involved in one.

3 · Policy Statements

What is an incident. A security incident is any actual or suspected event that compromises the confidentiality, integrity or availability of information – for example unauthorised access, data loss or leak, malware, account compromise, lost devices, or service disruption.

Report immediately. Anyone who suspects an incident must report it without delay to the Information Security Officer (or via the agreed channel). Early reporting is encouraged and never penalised; concealment is a serious breach.

Response lifecycle. Incidents are handled through: identification and triage → containment → eradication → recovery → post-incident review. Severity is assessed to prioritise response.

Roles during an incident. An incident lead coordinates response, decisions and communications. Technical responders contain and remediate. The CEO is informed of significant incidents and owns external communications.

Notification. Where an incident involves personal data, Nxt7a assesses obligations under the Notifiable Data Breaches scheme of the Privacy Act 1988 (Cth) and any other applicable breach-notification laws, and notifies affected individuals and regulators within required timeframes. Contractual notification obligations to clients and partners are also met.

Evidence and records. Incidents are logged, evidence preserved, and actions documented to support investigation, notification and improvement.

Learning. Every significant incident gets a post-incident review; findings feed corrective actions and updates to controls and policies.

4 · Roles & Responsibilities

• All personnel detect and report incidents.
• Information Security Officer / incident lead coordinates response and record-keeping.
• CEO approves external notifications and engages counsel ([COO or delegate]) where needed.

5 · Compliance, Monitoring & Breach

Failure to report a known incident, or to follow this policy, is itself a serious breach. Response performance and trends are reviewed.

6 · Related Documents

Information Security Policy · Access Control Policy · Data Classification & Retention Policy · Business Continuity & DR Policy · Privacy Policy.

7 · Standards Mapping

• B Corp: Customers.
• ISO/IEC 27001:2022: A.5.24–5.28 (incident management planning, assessment, response, learning, evidence).
• Statutory: Privacy Act 1988 (Cth) Notifiable Data Breaches scheme; applicable breach-notification laws.

Review note. Confirm NDB assessment thresholds and timeframes, and any client-contractual notification windows, with [COO or delegate].

8 · Version History