3.6.3

5.1.2.1 The organization shall have an incident response plan for how to respond to incidents of varying severity. If an organization is unable to manage some types of incidents on its own, the organization should have a plan for what it will do.

5.1.2.2 The incident response plan shall detail who is responsible for handling incidents including any relevant contact information for communicating to external parties, stakeholders and regulators. The organization shall have an up-to-date hard copy version of this plan available for situations where soft copies are not available.

5.1.2.3 The organization should consider purchasing a cyber security insurance policy that includes coverage for incident response and recovery activities or provide rationale for not purchasing one.

5.1.2.4 The organization may use the incident response plan template (see Annex A) as a measure of satisfying Requirements contained in Subsection 5.1.2.