Neobank Capital — Incident Response Policy

Effective Date: 18 september 2023

Issued by: Neobank Capital

Approved by: Chief Information Security Officer (CISO) & Data Protection Officer (DPO)

1. Purpose

The purpose of this Incident Response Policy is to establish a structured and coordinated approach for detecting, reporting, analyzing, and responding to security incidents affecting Neobank Capital systems, applications, and customer data.

This policy ensures that:

1. Data breaches and cybersecurity incidents are addressed swiftly and effectively.
2. Regulatory requirements (GDPR, UK GDPR, PCI DSS, NIST, and local laws) are met.
3. Damage to customers, assets, and reputation is minimized.
4. Lessons learned are applied to prevent recurrence.

2. Scope

This policy applies to:

1. All employees, contractors, vendors, and third-party service providers.
2. All systems, devices, applications, cloud environments, and decentralized infrastructure operated or managed by Neobank Capital.
3. All types of incidents including cybersecurity, operational, financial, privacy, or data protection events.

3. Definitions

1. Security Incident: Any confirmed or suspected event that threatens the confidentiality, integrity, or availability of Neobank Capital systems or data.
2. Data Breach: Unauthorized access, disclosure, or destruction of personal or financial information.
3. Critical Incident: An event with potential high impact on customers, regulatory compliance, or business continuity.

4. Incident Response Team (IRT)

Neobank Capital maintains a dedicated Incident Response Team (IRT) with the following roles:

5. Incident Classification and Prioritization

Incidents are classified based on severity, impact, and urgency:

6. Incident Detection and Reporting

1. All personnel must report suspected incidents immediately to the IRT via:
2. Email: security@neobank.capital
3. Phone (24/7 hotline): +1(844) 454 2508
4. Automated monitoring systems (SIEM, IDS/IPS, blockchain monitoring tools) provide real-time alerts.
5. Reports must include:
6. Description of the incident
7. Date/time detected
8. Affected systems or data
9. Initial impact assessment

7. Incident Response Phases

7.1 Preparation

1. Maintain updated IRP, contact lists, escalation procedures, and tools.
2. Conduct periodic simulations, tabletop exercises, and staff training.

7.2 Identification

1. Validate and confirm incidents.
2. Determine the type, scope, and potential impact.
3. Log all details in the incident tracking system.

7.3 Containment

1. Short-term containment: Isolate affected systems to prevent spread.
2. Long-term containment: Apply temporary fixes while planning full remediation.
3. Prioritize critical customer and financial data protection.

7.4 Eradication

1. Remove threats, malware, or vulnerabilities from affected systems.
2. Patch software, reset credentials, or revoke compromised keys.
3. Verify that the threat is completely eliminated.

7.5 Recovery

1. Restore systems and data to normal operation.
2. Conduct integrity checks to ensure data and system security.
3. Monitor for signs of recurrence.

7.6 Post-Incident Review

1. Conduct a lessons-learned analysis.
2. Update policies, procedures, and security controls.
3. Document findings and corrective actions in the incident report.

8. Regulatory Notification

1. For GDPR and other applicable privacy laws:
2. Notify relevant data protection authorities within 72 hours of confirmed personal data breaches.
3. Notify affected customers without undue delay if the breach poses high risk.
4. Maintain documentation of notifications, approvals, and timelines for audits.

9. Communication

1. Internal: Keep stakeholders informed on status and resolution.
2. External: Customer and public statements coordinated by Communications Officer and Legal Team.
3. Do not disclose sensitive incident details externally until authorized.

10. Roles and Responsibilities Summary

11. Documentation and Record-Keeping

1. All incidents must be logged in centralized incident management systems.
2. Records include:
3. Description and classification of the incident
4. Actions taken during response
5. Notifications to authorities or customers
6. Lessons learned and preventive measures
7. Retain logs and reports for at least 5 years or as required by law.

12. Training and Awareness

1. Mandatory annual training on incident detection and reporting for all staff.
2. Simulated breach exercises to ensure readiness.
3. Training updates aligned with regulatory changes and emerging cyber threats.

13. Policy Review and Updates

1. Reviewed annually or after any major incident, regulatory change, or operational update.
2. Updates require approval from the CISO and DPO.

14. Contact Information

Incident Response Team (IRT) Hotline

📧 security@neobank.capital

📞 +1(844) 454 2508

Data Protection Officer (DPO)

📧 privacy@neobank.capital

Chief Information Security Officer (CISO)

📧 security@neobank.capital