Effective: 25 May 2026
Owner: VeriPath Security
Review: 25 May 2027
This procedure defines how data security incidents are detected, reported, investigated, and resolved across the VeriPath infrastructure, in line with DSPT Standard 6 requirements.
An incident is any event that causes or has high probability of causing real harm — data loss, service downtime, unauthorised access, or compliance failure. Routine operations (e.g., a container restarting once, a CVE appearing in a weekly scan) are not incidents.
| Severity | Criteria | Response SLA |
|---|---|---|
| Critical | Data loss, security breach, >30min service outage, confirmed unauthorised access | Immediate report |
| High | Service degradation, repeated container failures, critical CVE with no available fix, backup failure >48h | Report within 24h |
| Medium | Persistent warnings, isolated container crash, single backup failure | Flag for review |
| Low | Minor config drift, single scan anomaly | Log only |
Rule of thumb: If the answer to "Will this cause real harm if it stays unresolved for 24 hours?" is yes, it is an incident.
The following are monitored continuously via automated scanning:
| Trigger | Source | Frequency |
|---|---|---|
| Container unhealthy for 3+ consecutive checks | Docker health checks | Live |
| Service health check fails for >5 minutes | Dashboard API | Per-page-load |
| Backups fail for 2+ consecutive days | Backup freshness check cron | Daily |
| New critical CVE with active exploitation | Trivy weekly scans | Weekly (Sat 3am) |
| Unexpected open port detected | Nmap scans | Weekly (Sun 3:30am) |
| Watchtower update causes crash-loop | Container status check | Live |
| Manual report from staff/user | Human report | As needed |
┌──────────────────┐
│ Incident occurs │
└────────┬─────────┘
│
┌─────────────┴─────────────┐
│ │
┌─────────▼─────────┐ ┌───────────▼──────────┐
│ Automated trigger │ │ Staff/user reports │
│ (scanner detects) │ │ (human observation) │
└─────────┬─────────┘ └───────────┬──────────┘
│ │
└─────────────┬─────────────┘
│
┌─────────────▼─────────────┐
│ Security Ops Agent │
│ • Assesses severity │
│ • Determines scope │
│ • Gathers timeline │
└─────────────┬─────────────┘
│
┌─────────────▼─────────────┐
│ Wiki Librarian │
│ • Creates incident page │
│ • Sets status tag │
│ • Updates index │
└─────────────┬─────────────┘
│
┌─────────────▼─────────────┐
│ Security Dashboard │
│ • Displays incident │
│ • Shows status badge │
│ • Links to full report │
└───────────────────────────┘
Open ──────► Investigating ──────► Resolved
│ │ │
▼ ▼ ▼
Reported RCA underway All corrective
(initial (timeline, actions completed
assessment) scope, impact) and verified
Each incident page in the wiki (located at infrastructure/security/incidents/<incident-name>) includes:
A mandatory **Status:** metadata line is included in every incident page. The Security Dashboard reads this line to display a coloured status badge:
**Status:** Open | <date> — new, uninvestigated**Status:** Investigating | <date> — root cause analysis in progress**Status:** Resolved | <date> — all corrective actions completed| Role | Responsibility |
|---|---|
| Security Ops Agent | Detects incidents, assesses severity, creates report content, tracks to resolution |
| Wiki Librarian | Creates and updates incident wiki pages, maintains incidents index |
| Security Dashboard | Displays incident status with colour-coded badges, links to full reports |
| All Staff | Report any suspected incidents immediately via the Security Ops Agent chat interface on the dashboard |
A documented incident is maintained at:
This demonstrates the full lifecycle: detection → investigation → corrective actions → verified resolution.
| Evidence | Location |
|---|---|
| Incident response procedure | This page |
| Incident lifecycle documentation | infrastructure/security/incidents/ in the wiki |
| Worked example | 14 May 2026 incident report |
| Incident status tracking | Security Dashboard at security.veripath.co.uk/dashboard/ |
| Automated detection pipeline | Weekly Trivy scans, Nmap scans, backup freshness checks |
| Agent awareness | Security Ops Agent and Wiki Librarian system prompts document the process |