Initial Event Detection and Plan Initiation

Initiation of this plan occurs upon the observation of an event that might have information security or business continuity implications. Examples include:

A discontinuity or outage or other event impacting a facility, staff, or IT resources
A user experiencing a problem with his/her workstation
IT may discover a problem
Antivirus alert or other IT intrusion detection system alert
Physical security staff report an incident
A client or business partner notifies IT of an outage or potential security issue
A manager reports an outage or potential security issue
An outside source reports an outage or potential security issue
The discovery of a fraudulent online transaction, financial or otherwise
A fraudulent online request by a vendor to change payment instructions

Anyone observing an event that might have information security or business continuity implications is to immediately notify the ISM.