5.26

5.1.2.1 The organization shall have an incident response plan for how to respond to incidents of varying severity. If an organization is unable to manage some types of incidents on its own, the organization should have a plan for what it will do.

5.1.2.2 The incident response plan shall detail who is responsible for handling incidents including any relevant contact information for communicating to external parties, stakeholders and regulators. The organization shall have an up-to-date hard copy version of this plan available for situations where soft copies are not available.