Incident Response Policy

Incident Response Policy

Version: 1.0 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: annually

Purpose

This policy defines how Pocket PMO detects, contains, communicates and recovers from security and privacy incidents.

Definitions

• Event. Any observable occurrence in the platform.
• Incident. An event, or set of events, that adversely affects confidentiality, integrity or availability of customer data or the Service.
• Personal data breach. As defined by UK GDPR Article 4(12).

Detection

Signals monitored:

• Application errors (Sentry, where enabled).
• Database and edge-function logs.
• security_events, failed_login_attempts, rate_limits.
• Customer reports (support tickets, admin@pocketpmo.co.uk).
• Third-party notifications from sub-processors.

Roles

• Incident commander: named lead within the Pocket PMO team, reachable at admin@pocketpmo.co.uk. Small-team model: 24-hour acknowledgement target on working days (S-07).
• Technical lead: engineering owner of the affected component.
• Comms lead: prepares customer notifications.
• Privacy lead: assesses regulatory notification duties — owner-confirmation L-03.

Severity levels

Workflow

1. Detect & triage. Confirm the event, assign a severity, name an incident commander.
2. Contain. Apply immediate mitigations (rate-limit, feature flag, rollback).
3. Investigate. Preserve logs; scope impact; identify data categories touched.
4. Notify.
   • If a personal data breach is confirmed and likely to result in a risk to individuals, notify the ICO within 72 hours of confirmation (UK GDPR Art. 33), and notify affected customers within 72 hours of confirmation (owner-confirmed SLA; Art. 34 where required).
   • Post an update on the status route.
   • Notify affected customers directly by email (see Incident Communications Templates).
5. Recover. Restore service. Where necessary, restore from backup (see Disaster Recovery Summary).
6. Post-incident review. Root-cause analysis within 10 business days; corrective actions logged and tracked to closure.

Customer communications

• Status posts at /api-status and the Trust Centre's status route.
• Direct email for material incidents.
• Post-incident summary within 10 business days.

Regulator communications

Where an incident constitutes a personal data breach with a risk to rights and freedoms of individuals, the Privacy Lead notifies the ICO within 72 hours of confirmation.

Owner confirmation required

• S-07 IR rota (24h response, solo/small team) and L-03 privacy lead confirmed 15 Jul 26.

Document history