1. Purpose
To establish guidelines and responsibilities for identifying, reporting, handling and resolving information security incidents, minimizing operational, financial and reputational impacts.
2. Scope
This policy applies to all employees, third parties, service providers and partners who use or have access to the organization’s information assets.
3. Definition of an Incident
A security incident is any event that compromises or has the potential to compromise the confidentiality, integrity or availability of the organization’s information or systems.
Examples include:
- Unauthorized access
- Data breaches
- Malware or ransomware
- Lost or stolen devices
- Unavailability of critical systems
4. General Guidelines
4.1 Incident Reporting
- Every employee must immediately report any incident or suspected incident.
- The official reporting channel is: seguranca@techaze.com.br.
- Critical incidents must be reported immediately to the IT/Security department.
4.2 Classification
Incidents must be classified according to their impact and severity (low, medium, high or critical).
4.3 Incident Handling
- The responsible team must analyze the incident, contain and eradicate the threat, and recover the affected environment.
- Whenever necessary, corrective measures must be applied to prevent recurrence.
4.4 Recording and Documentation
- All incidents must be recorded.
- Reports detailing the cause, impact and actions taken must be maintained.
- Records must be stored in accordance with the company’s retention policy.
4.5 External Communication
Where applicable, communication with clients, partners or regulatory authorities will be handled by executive management or the legal department, in accordance with legal requirements (e.g., the LGPD, the Brazilian General Data Protection Law).
5. Responsibilities
- Employees: Report incidents immediately.
- Managers: Ensure their teams know the procedures.
- IT / Information Security: Coordinate the response, record incidents and propose improvements.
- Executive Management: Support strategic decisions during critical incidents.
6. Training and Awareness
The organization will provide periodic training on identifying and reporting security incidents.
7. Disciplinary Measures
Failure to comply with this policy may result in disciplinary measures in accordance with internal rules.
8. Effective Date and Review
This policy takes effect on its publication date and must be reviewed annually or whenever necessary.
Contact
To report security incidents, contact us immediately: