John Thomas Fintech Private Limited • ISO/IEC 27001:2022

PRO-02: INFORMATION SECURITY INCIDENT MANAGEMENT PROCEDURE

JOHN THOMAS FINTECH PRIVATE LIMITED

CIN: U62099KL2026PTC106017 | Doc ID: JT-ISMS-PRO-002

Version: 1.0 | Effective Date: 14-Oct-2026 | Review Cycle: Annual

ISO/IEC 27001:2022 Controls: 5.24 (Incident planning), 5.25 (Assessment of events), 5.26 (Response to incidents), 5.27 (Learning from incidents), 5.28 (Collection of evidence)

Statutory Mandate: CERT-In 6-Hour Cyber Incident Reporting Rule (April 2022)

1. Purpose & Incident Response Team (SIRT)

This procedure establishes a structured, end-to-end response framework for detecting, containing, investigating, eradicating, and reporting cybersecurity incidents.

Security Incident Response Team (SIRT):

Incident Commander: CISO / Security Lead
Technical Leads: Cloud DevOps Lead & Lead Software Architect
Communications & Legal: Managing Director / Legal Counsel

2. Incident Classification & Severity Matrix

Priority	Definition	Examples	Response SLA	Reporting SLA
P1 - Critical	Catastrophic security breach, customer financial data compromised, total system outage, active ransomware.	Production DB leak, unauthorized root access, ransomware encryption.	Containment < 1 hour	CERT-In notice within 6 hours
P2 - High	Major security event with partial impact or elevated risk of data compromise.	Active brute force on API gateway, unpatched critical RCE vulnerability, loss of encrypted corporate laptop.	Containment < 4 hours	Regulatory notice if customer data at risk
P3 - Medium	Minor security issue; no customer financial data compromised.	Isolated malware on non-critical endpoint, suspicious phishing email reported.	Containment < 24 hours	Internal log within CAR register
P4 - Low	Security event with minimal risk.	Port scan against external firewall blocked by WAF, single failed login attempt.	Monitored	Internal report

3. Incident Lifecycle Workflow


   [1. Identification] ---> [2. Triage & Classify] ---> [3. Containment] ---> [4. Eradication] ---> [5. Recovery] ---> [6. Post-Incident Review]
    CloudWatch/SIEM alert    Assign P1-P4 Severity      Isolate affected VPC    Remove malware / revoke   Restore from trusted   5-Whys Root Cause
    Internal staff report    Mobilize SIRT              Revoke credentials      Patch vulnerability       encrypted snapshot     CERT-In final filing

Phase 1: Detection & Identification

Security events are ingested via CloudWatch, GuardDuty, and internal employee reporting channels (security@johnthomasfintech.com).

Phase 2: Containment

Short-Term Containment: Isolate compromised virtual instances (quarantine security group), revoke compromised IAM tokens, block attacking IP ranges at AWS WAF.
Evidence Preservation: Take forensic memory snapshots and disk clones prior to terminating instances. Preserve cryptographic checksums of system logs.

Phase 3: Eradication & Recovery

Eliminate threat root causes, rotate all system secrets and database passwords.
Verify system integrity and restore services from verified immutable backups.

Phase 4: Statutory Reporting to CERT-In (Within 6 Hours)

For specified cyber incidents (data breach, ransomware, targeted attacks, compromise of critical systems):

Submit formal incident notification to CERT-In (incident@cert-in.org.in) within 6 hours of notice.
Provide initial incident details using CERT-In's incident reporting format.

Phase 5: Post-Incident Review (PIR)

Within 5 business days, convene the SIRT to conduct a 5-Whys Root Cause Analysis, update the Incident Log (REG-04), and issue a Corrective Action Request (REG-05).