1
Decide how serious it is
Use P1–P4 examples to separate a suspicious download from a confirmed customer-data leak and start the right escalation.
What This Resource Includes
Use it when an alert comes in and nobody is sure who should contain the account, preserve logs, contact Legal, or decide whether customers and regulators must be notified.
2
Contain without losing evidence
Record who disabled the account, isolated the device, captured logs, and approved each investigation step.
3
Know who to contact
Give Security, IT, HR, Legal, Privacy, and executives clear handoffs, notification triggers, and ready-to-edit messages.
Built for Insider Breach Response
Picture a common Monday morning: an employee gives notice, a DLP alert shows a 20 GB upload, and the manager is asking whether to shut the account down. This SOP turns that scramble into a sequence—validate the signal, preserve evidence, contain the risk, involve the right people, assess impact, and document the outcome.
- Handle real cases such as bulk customer exports, source-code uploads, USB copies, suspicious cloud sharing, and access after termination.
- Assign an owner for every action so the incident does not stall between Security, IT, HR, Legal, and the business manager.
- Capture the exact evidence and decisions needed for an HR review, legal hold, customer explanation, or regulator response.
- Finish with recovery, notification decisions, and a short list of controls to fix before the next incident.
