Cybersecurity Incident Escalation & Management Process

PART A — Cybersecurity Incident Escalation Process

Purpose of the Policy

This document establishes a formal process for identifying, reporting, assessing, escalating, and managing cybersecurity incidents within Legistify. Its objective is to ensure that security incidents are handled in a timely, consistent, and controlled manner, minimising potential impact to the organisation, its clients, and its data, while supporting compliance with applicable information security standards and contractual obligations.

Procedures

Scope

This process applies to all employees, contractors, and third parties operating on behalf of Legistify, and covers the following:

Incident Reporting

All employees and relevant teams must promptly report any suspected or confirmed cybersecurity incident to the designated IT/Security team through the approved Zoho communication or ticketing channel. Timely reporting is critical to enabling effective assessment, containment, and resolution of potential threats.

Incident Severity & Escalation

Incidents are classified by severity to determine the appropriate escalation path and urgency of response, as outlined below:

Escalation Process

Incidents progress through the following stages:

Detection → Reporting → Initial Assessment → Severity Classification → Containment → Escalation → Investigation → Recovery → Closure

Incidents are escalated immediately, regardless of initial classification, where any of the following conditions apply:

Roles & Responsibilities

Incident Documentation

All incidents must be documented to support accountability, root-cause analysis, and continuous improvement. Documentation must include, at a minimum: incident details, timeline of events, affected assets, collected evidence, actions taken, escalation history, root cause, and final resolution.

Incident Closure

An incident may be formally closed once the following have been completed: containment of the threat, recovery of affected systems and data, validation that normal operations have been restored, complete documentation of the incident, and implementation of any required corrective actions.

Review

This process is reviewed periodically, as well as following any significant security incident or major change to the organisation's environment, to ensure it remains effective and aligned with current risks and operational requirements.

PART B — Cybersecurity Incident Management Process

Purpose

This section defines the process by which Legistify identifies, logs, categorises, investigates, and resolves cybersecurity incidents. It ensures incidents are managed consistently from detection through closure, with clear ownership, documentation, and traceability, supporting the organisation's information security objectives and audit requirements, and complementing the Cyber Incident Escalation Process set out in Part A.

Scope

This process applies to all employees, contractors, and third parties, and covers all cybersecurity-related events affecting endpoints, servers, cloud infrastructure, applications, network devices, accounts, data, and third-party services.

Incident Classification

Incidents are classified by severity to guide response prioritisation, consistent with the severity framework in Part A:

Roles & Responsibilities

Incident Ticket Template

The following fields must be captured for every logged incident, at the appropriate stage of the lifecycle:

Documentation & Recordkeeping

Completed incident tickets, together with supporting evidence and communications, must be retained in accordance with the organisation's records retention requirements, and made available for internal review and external audit as required.

Review

This process, and the associated incident ticket template, are reviewed periodically and following any significant security incident or major change to the organisation's environment, to ensure continued effectiveness.

Policy Revision History