Add to Cart

POLICY STATEMENT

At addtocart.co.uk , we are committed to maintaining a secure environment for our employees, customers, and confidential information. This Security Incident Policy outlines our approach to identifying, reporting, assessing, and responding to security incidents. It is designed to minimize the impact of security incidents and ensure their timely resolution, while also facilitating the collection of valuable information for future prevention and improvement.

SCOPE

This policy applies to all employees, contractors, consultants, and any individuals granted access to addtocart.co.uk systems, networks, or physical premises.

DEFINITION OF SECURITY INCIDENT

A security incident is any unauthorized or unintended event that compromises the confidentiality, integrity, or availability of addtocart.co.uk information assets, systems, networks, or physical facilities. Examples include but are not limited to

Unauthorized access to systems or networks.

Malware infections, including viruses, ransomware, or spyware.

Data breaches or leaks.

Physical theft or loss of company assets.

Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.

Social engineering attempts.

Any suspicious or unusual activity that may indicate a potential security breach.

REPORTING SECURITY INCIDENTS

Any employee who suspects or discovers a security incident must report it immediately to their supervisor, the IT department, or the designated security incident response team.

Contractors, consultants, or other external personnel should report incidents to their immediate supervisor or contact person within addtocart.co.uk.

Incident reports should include as much relevant information as possible, such as the date, time, location, nature of the incident, individuals involved, and any potential impact.

Employees must not attempt to investigate or remediate security incidents independently, unless explicitly authorized to do so.

SECURITY INCIDENT RESPONSE

The designated security incident response team will promptly evaluate and respond to reported security incidents.

The response team will assess the severity and impact of the incident and determine the appropriate course of action.

Incident response may involve containment, investigation, remediation, communication, and recovery activities.

The response team will keep affected individuals informed about the incident, the actions being taken, and any relevant updates.

Legal, regulatory, and contractual obligations will be considered during the incident response process.

A post-incident review will be conducted to identify lessons learned and implement measures to prevent similar incidents in the future.

ROLES AND RESPONSIBILITIES

Management: Provide leadership, oversight, and necessary resources to support effective security incident response.

Security Incident Response Team: Responsible for assessing, coordinating, and responding to security incidents.

Employees: Promptly report security incidents, cooperate with incident response efforts, and adhere to security protocols.

POLICY COMPLIANCE

Non-compliance with this Security Incident Policy may result in disciplinary action, up to and including termination of employment or contract.

POLICY REVIEW

This policy will be reviewed annually or as needed to ensure its effectiveness, relevance, and compliance with changing business needs and regulatory requirements.