1. DOCUMENT PURPOSE

1.1. This document outlines Vendo's policy for managing security incidents, ensuring rapid and effective response to protect client data, and maintaining business continuity.

1.2. It includes a step-by-step guide of the measures Personnel must take to manage the lifecycle of Security Incidents within Vendo, from initial Security Incident recognition to restoring normal operations. This process will ensure that all such Security Incidents are detected, analyzed, contained, and eradicated. Measures are taken to prevent any further Security Incidents and, where necessary or appropriate, that notice is provided to law enforcement authorities, Personnel, and/or affected parties.

1.3. It applies to all employees, contractors, and interns (collectively referred to as "Personnel") within Vendo, overriding any previous policies related to security incident management.

2. TERMS & DEFINITIONS

• Data Breach: An incident affecting the security of Personal Data, including any information that can identify an individual, whether directly or indirectly. This term encompasses incidents involving Personal Information, Sensitive Information, and Identifiable Information.
• Data Controller: The entity (person or organization) that decides how and why Personal Data is processed.
• Abnormal Activities: Unsuccessful attacks that appear particularly significant based on Vendo's understanding of the risks they face.
• Escalation: Involving additional resources or higher levels of management to address or manage a security incident.
• Incident Response (IR) / Incident Management: The comprehensive process of identifying, managing, recording, and analyzing security threats or incidents in real time.
• Information Security: Measures and processes in place to protect digital and non-digital information from unauthorized access, disclosure, disruption, modification, or destruction.
• Personal Data: Any data related to an identifiable individual protected under privacy laws. This term is used consistently throughout the document to include any data that could identify a person directly or indirectly.
• Security Event: An identified or suspected occurrence indicating a possible information security or policy breach.
• Security Incident: A confirmed occurrence representing a breach of information security, potentially impacting business operations and data confidentiality, integrity, or availability.