Security Incident Report Sample Philippines

Standard Operating Procedure: Security Incident Report (Philippines)

Document ID: OPS-SEC-PH-001
Classification: Restricted / Internal Use

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

This procedure mandates the standardized documentation of security incidents occurring within Philippine-based operations. It ensures compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations as enforced by the National Privacy Commission (NPC).

Scope: Applies to all personnel, third-party contractors, and physical assets located in the Philippines. Covers cyber breaches, physical security compromises, and personal data breaches requiring notification to the NPC.

---

3. Prerequisites & Tool Requirements

• Access: Secure VPN, Privileged Account Management (PAM) credentials.
• Software: Enterprise Incident Management System (e.g., Jira Service Management, ServiceNow), Encrypted Communication Channel (Signal/Internal Vault).
• Regulatory Documentation: NPC Personal Data Breach Notification Form template.
• Hardware: Encrypted workstation with secondary multi-factor authentication (MFA) device.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase 1: Identification & Initial Containment

• Document precise timestamp and location of the incident.
• Isolate compromised assets to prevent lateral movement.
• Initiate "Evidence Preservation Mode" (capture logs, screenshots, and system states without modification).

Phase 2: Incident Reporting

• Complete the internal Security Incident Report Form (SIRF).
• Validate if the breach involves Sensitive Personal Information (SPI).
• Escalate to the DPO if a data breach threshold (as defined by NPC Circular 16-03) is met.

Phase 3: Reporting to Authorities

• Draft the breach report for the NPC within 72 hours of discovery.
• Ensure all PII (Personally Identifiable Information) exposure is categorized.
• Secure sign-off from Legal Counsel before external transmission.

---

6. Quality Assurance & Verification Criteria

• Tolerance Threshold: 0% error rate for PII exposure classification.
• Timeline Benchmark: Initial internal report must be filed within 4 hours of incident confirmation.
• Audit Check: Quarterly reconciliation of incident logs against NPC notification records.
• Verification: DPO validation of "Root Cause Analysis" (RCA) completeness before case closure.

---

7. Practical Troubleshooting Scenarios

Scenario A: Evidence chain is broken during initial response.

• Corrective Action: Halt containment, immediately document the gap in the chain of custody. Declare a "partial incident integrity failure" and notify the Legal Counsel to adjust the disclosure strategy to avoid misrepresentation in court.

Scenario B: The 72-hour NPC deadline is imminent but data is incomplete.

• Corrective Action: Submit a "Preliminary Notification" stating that the investigation is ongoing. Explicitly mention that supplemental information will be provided as it becomes available to maintain compliance with NPC reporting requirements.

Scenario C: Incident is a result of a third-party vendor compromise.

• Corrective Action: Activate the "Vendor Liability Clause" in the SLA. Demand the vendor’s internal incident log within 2 hours. Do not rely solely on vendor claims; verify logs through independent forensic audit logs if accessible.