Purpose and incident scope
NexCommand must respond promptly and proportionately to suspected compromise, unauthorized disclosure, malicious activity and material loss of system or information availability. This policy covers corporate systems, hosted services, supplied software, customer support and third-party incidents affecting the agreed service. An AI-related disclosure, unsafe tool action or compromised knowledge source may also require response.
The approach is informed by NIST SP 800-61 Revision 3. A response plan must be tailored to real systems, people and contractual duties. This public policy does not disclose internal detection rules or assert a staffed 24/7 security operations center.
Preparation and accountable roles
Executive management must appoint an incident sponsor and a competent response lead, with alternates and current contact details. Security coordinates triage and technical investigation; system owners implement authorized containment; legal advises on duties and privilege; communications coordinates factual external statements; contract owners manage customer and supplier obligations.
Maintain an inventory of critical systems, response contacts, escalation paths, secure communication methods and recovery dependencies. Test access to required reporting portals before an emergency. Contracts must identify who reports what, to whom and by when. Do not assume a provider's notification will satisfy NexCommand's own duties.
Reporting, triage and severity
Personnel must report suspected incidents promptly through internal management or the designated security route. External reporters must use Contact with a non-sensitive description and request a secure channel for technical details. This policy does not authorize intrusive testing, access to another customer's data or publication of exploit details.
The response lead must record discovery time, affected services, known facts, uncertainty, reporter and immediate actions. Assess data sensitivity, affected parties, operational impact, evidence of active compromise and contractual triggers. Set severity and escalation according to a documented matrix; revise it when evidence changes. A low initial impact estimate must not close investigation of a credible data-exposure concern.
Containment and evidence preservation
Contain unauthorized access and prevent further harm using approved actions proportionate to the incident. Options may include isolating a host, disabling a credential, restricting an integration or suspending a feature. Coordinate actions that could affect customer operations or destroy evidence. Do not wipe systems, delete logs or run unapproved forensic tools simply to restore service quickly.
Preserve relevant logs, files, configurations and communication records. Document collection, custodian, time, integrity checks and transfers. Protect sensitive evidence and restrict access. Record the basis for any necessary emergency action. Where a defense clause applies, use the specific reporting and preservation obligations described in the DFARS guide; do not replace those deadlines with a generic internal target.
Notification and communication
Legal and contract owners must assess customer, government, regulator, individual and insurer notifications against the applicable facts and duties. Maintain a deadline register and named submitter. Initial notifications must state verified facts, known impact, containment and next updates, with uncertainty clearly identified. Do not wait for perfect information where an applicable deadline requires earlier reporting.
Only authorized representatives may make company statements. Avoid speculation, premature attribution or assurances that no data was affected before verification. Keep customers informed through agreed contacts and secure channels. Cooperation with law enforcement or a customer must respect lawful authority, confidentiality and evidence integrity.
Eradication, recovery and learning
Remove the cause of compromise, address vulnerabilities and verify that recovery will not reintroduce the same condition. Restore from appropriate sources, validate critical functions and monitor the recovered environment. The responsible owner must authorize return to service against documented criteria. Retain a rollback or further-containment plan when risk remains.
After stabilization, review root cause, timeline, control failures, communications and recovery performance. Assign corrective actions and verify effectiveness. Feed lessons into training, architecture, supplier review and continuity planning. Review the playbook after major changes and exercise realistic scenarios involving personnel, technical and contractual decisions.
Records, exceptions and review
The policy owner must maintain the records needed to demonstrate implementation: applicable requirements, named responsibilities, training, approvals, exceptions, reviews and corrective actions. Records must be access-controlled, retained under the applicable retention schedule and protected from unauthorized amendment or disposal. Legal holds and contract-specific retention requirements take precedence over routine deletion.
An exception must identify its scope, business reason, risk, compensating measures, accountable approver and expiry date. It must be approved before the affected activity proceeds and reviewed when circumstances change. No exception can authorize unlawful conduct, remove a contractual obligation or conceal a nonconformity. Unresolved issues must be escalated to executive management and the relevant professional adviser.
The policy owner reviews this policy at least annually and after a material legal, business, product or incident-driven change. Revisions require authorized approval and document control. Supporting procedures, responsibility assignments and implementation evidence are controlled records. Statements of certification or contractual compliance must identify their scope and supporting evidence.