Incident Response Policy

Important:

This document is a professional draft, not legal advice. It must be reviewed against elyXion’s final legal entity details, implemented controls, suppliers, customer contracts, and actual operating practices before publication.

1. Purpose

This policy establishes elyXion’s approach to security incidents affecting systems, services, identities, data, infrastructure or suppliers.

2. Response Lifecycle

1. Detection and reporting
2. Triage and classification
3. Containment
4. Investigation and evidence preservation
5. Eradication or corrective action
6. Recovery and validation
7. Communication and notification
8. Post-incident review

3. Prioritisation

Incidents are prioritised by business impact, data sensitivity, affected customers, exploitability, disruption, legal obligations and potential continued harm.

4. Data Breaches

Suspected Personal Data Breaches are assessed without undue delay. Where elyXion acts as processor, affected controllers are notified according to the DPA and applicable law.

5. Lessons Learned

Material incidents receive a review covering root cause, control gaps, corrective actions, ownership and follow-up.

Security concerns may be reported to support@elyxion.eu.