Internal Use

Incident Response Policy

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

The purpose of this policy is to define how Dispel prepares for, detects, analyzes, responds to, and recovers from security incidents.

1.2 Scope

This policy applies to:

• All Dispel workforce members and external parties (“Users”) who access or support Dispel systems and services.
• All environments supporting Dispel services, including the Dispel Zero Trust Engine (DZTE) and related infrastructure.
• All information systems and data assets in scope for Dispel’s security and compliance program.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL establish, maintain, and continually improve an incident response capability that:

• Detects, analyzes, contains, eradicates, and recovers from security incidents in a timely manner.
• Coordinates with disaster recovery and contingency planning activities.
• Satisfies applicable regulatory and contractual requirements for incident response and reporting.

2.3 Secondary Policy Statement

• Incident response plans and procedures SHALL be documented, approved, and tested.
• Incidents and lessons learned SHALL be documented and used to improve controls and procedures.

3. REQUIREMENTS

3.1 Governance and Coverage

Objective: Define who is covered by this policy and how it is governed.

Mandatory Activities:

1. All workforce members and external parties who access or support Dispel systems SHALL be treated as Covered Persons for incident response purposes.
2. Covered Persons SHALL review, accept, and acknowledge this document prior to being granted access and at least annually thereafter.
3. The Policy Owner SHALL review and, where necessary, update this policy and associated procedures at least annually and following significant changes.

Required Outputs:

• Current list of Covered Persons.
• Records of annual policy acknowledgements.
• Evidence of annual policy review and updates.

Security Controls: NIST SP 800-53 IR-1.

3.2 Training and Awareness

Objective: Ensure personnel are trained to fulfill incident response roles and responsibilities.

Mandatory Activities:

1. The incident response training program SHALL be maintained and kept up to date.
2. Personnel assigned to incident response roles SHALL complete role-appropriate training within a defined time after assuming the role, and at least annually.
3. The training program SHOULD include simulated events or exercises where feasible.

Required Outputs:

• Incident response training curriculum and schedule.
• Training completion records for covered personnel.

Security Controls: NIST SP 800-53 IR-2.

3.3 Testing, Exercises, and Coordination

Objective: Validate the effectiveness of incident response capabilities.

Mandatory Activities:

1. Incident response capabilities SHALL be tested at a defined cadence (e.g., at least annually).
2. Testing SHALL be coordinated with disaster recovery and contingency planning teams.
3. Test results and lessons learned SHALL be documented and used to update the incident response plan, procedures, and training.

Required Outputs:

• Incident response test plans and results.
• Documented lessons learned and follow-up actions.

Security Controls: NIST SP 800-53 IR-3.

3.4 Incident Handling and Monitoring

Objective: Ensure consistent and effective handling of incidents.

Mandatory Activities:

1. Dispel SHALL maintain an incident handling process aligned with the Incident Response Plan, including preparation, detection and analysis, containment, eradication, and recovery.
2. Monitoring and logging capabilities SHALL support incident detection and investigation.
3. Incidents SHALL be categorized, prioritized, and tracked through resolution.

Required Outputs:

• Incident handling procedures.
• Incident records and tracking artifacts.

Security Controls: NIST SP 800-53 IR-4, IR-5, IR-6.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner

Responsibilities:

• Owns this Incident Response Policy.
• Ensures integration with logging, vulnerability management, and business continuity policies.

4.2 Incident Response Lead / Team

Responsibilities:

• Coordinate incident response activities.
• Maintain the incident response plan and related procedures.
• Report on incident metrics and trends.

4.3 System Owners

Responsibilities:

• Support detection and analysis of incidents affecting their systems.
• Implement containment, eradication, and recovery actions as directed.

5. PROCEDURES

5.1 Incident Response Lifecycle (High-Level)

6. MONITORING AND COMPLIANCE

Compliance with this policy SHALL be monitored through:

• Reviews of incident records and post-incident reports.
• Audits of incident response testing and training activities.

7. EXCEPTIONS AND WAIVERS

Exceptions to this policy SHALL follow the documented exception management process and require appropriate approvals.

8. DEFINITIONS

Incident: An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system, or constitutes a violation or imminent threat of violation of law, security policies, or acceptable use policies.

9. REFERENCES

• NIST SP 800-61 Incident Handling Guide.
• NIST SP 800-53, IR family.
• Business Continuity and Disaster Recovery plans.

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

APPENDICES

Appendix A: Supporting Incident Response Procedures

Appendix B: Additional Guidance and Examples