Řízení incidentů

Verze: 1.0 | Efektivní od: 1. ledna 2026

1. Účel

Tato směrnice definuje proces řízení bezpečnostních incidentů včetně detekce, response, notification a recovery.

2. Definice incidentu

2.1 Typy incidentů

Typ	Příklady	Regulace
Data Breach	Únik dat, unauthorized access	GDPR
Security Incident	Malware, ransomware, intrusion	NIS2
AI Incident	Bias, hallucination, malfunction	AI Act
Availability	DDoS, system failure	NIS2
Compliance	Policy violation	Internal

2.2 Severity Classification

Severity	Definice	Response Time	Escalation
Critical	Business critical impact, data breach	<1h	CEO + Board
High	Significant impact, potential breach	<4h	C-level
Medium	Limited impact, contained	<24h	Management
Low	Minimal impact, no data at risk	<72h	Team lead

3. Incident Response Team (IRT)

3.1 Složení týmu

Role	Primární	Backup
Incident Commander	CISO	IT Director
Technical Lead	Security Engineer	SRE Lead
Communications	PR Manager	CEO
Legal	CLO	External counsel
DPO	DPO	Privacy consultant
Business	COO	Department head

3.2 Kontaktní informace

INCIDENT HOTLINE: [PLACEHOLDER]
EMAIL: security@firma.cz
SLACK: #incident-response

On-call rotation:

Týden	Kontakt
Week 1	[Name 1]
Week 2	[Name 2]
Week 3	[Name 3]
Week 4	[Name 4]

4. Incident Response Process

4.1 Fáze response

5. Notification Requirements

5.1 Internal Notification

Severity	Notify	Timeline
Critical	CEO, Board, All C-level	Immediate
High	CISO, CTO, relevant C-level	<1h
Medium	CISO, Team leads	<4h
Low	CISO	<24h

5.2 External Notification (Regulatory)

Regulace	Autorita	Timeline	Trigger
GDPR	ÚOOÚ	72h	Personal data breach
NIS2	NÚKIB	24h (initial), 72h (full)	Significant incident
AI Act	–	Document	AI incident

5.3 Notification Templates

Initial Notification (24h) - NÚKIB:

Incident ID
Detection time
Affected systems
Initial assessment
Containment status
Contact info

Full Report (72h) - ÚOOÚ:

Nature of breach
Categories of data
Number of subjects
Likely consequences
Measures taken
DPO contact

6. Data Breach Specific Process

6.1 Data Breach Assessment

Data Breach Checklist:

6.2 Subject Notification Criteria

Notifikovat subjekty pokud:

Vysoké riziko pro práva a svobody
Nešifrovaná citlivá data
Financial data exposed
Health data exposed
Credentials exposed (plaintext)

6.3 Subject Notification Content

Co se stalo (bez technických detailů)
Jaká data byla dotčena
Jaké je riziko
Co děláme
Co můžete udělat vy
Kontakt na DPO

7. AI Incident Specific Process

7.1 AI Incident Types

Typ	Příklad	Severity
Bias	Discriminatory outputs	High
Hallucination	Factually incorrect	Medium
Privacy leak	PII in outputs	Critical
Malfunction	System not working	Medium
Adversarial	Model manipulation	High

7.2 AI Incident Response

8. Communication

8.1 Internal Communication

Audience	Channel	Frequency
IRT	War room / Slack	Continuous
Management	Email + call	Every 4h (critical)
Employees	Email	As needed

8.2 External Communication

Audience	Odpovědnost	Approval
Regulators	DPO / CISO	CLO
Customers	PR + CS	CEO
Media	PR	CEO
Partners	Account manager	COO

8.3 Communication Templates

Internal Status Update:

Subject: [INCIDENT-XXX] Status Update #N

Current Status: [ACTIVE/CONTAINED/RESOLVED]
Severity: [CRITICAL/HIGH/MEDIUM/LOW]

Summary: [2-3 sentences]

Timeline:
- [Time]: [Event]
- [Time]: [Event]

Current Actions:
- [Action 1]
- [Action 2]

Next Update: [Time]
Incident Commander: [Name]

9. Documentation

9.1 Incident Record

Každý incident musí obsahovat:

Pole	Popis
Incident ID	Unikátní identifikátor
Detection time	Kdy zjištěno
Start time	Kdy začalo (odhad)
End time	Kdy vyřešeno
Severity	Classification
Type	Data breach / Security / AI
Description	Co se stalo
Impact	Jaký dopad
Root cause	Příčina
Actions taken	Co jsme udělali
Lessons learned	Co zlepšit
Follow-up actions	Preventivní opatření

9.2 Retention

Dokument	Retention
Incident report	5 let
Evidence	5 let
Communication logs	5 let
Forensic reports	5 let

10. Post-Incident Review

10.1 Post-Mortem Template

POST-MORTEM: [INCIDENT-XXX]

1. INCIDENT SUMMARY
   - What happened
   - Timeline
   - Impact

2. ROOT CAUSE ANALYSIS
   - What failed
   - Why it failed
   - Contributing factors

3. WHAT WENT WELL
   - Effective responses
   - Good decisions

4. WHAT COULD BE IMPROVED
   - Gaps identified
   - Process issues

5. ACTION ITEMS
   - Preventive measures
   - Process improvements
   - Training needs
   - Tool improvements

6. FOLLOW-UP
   - Owner for each action
   - Deadlines
   - Review date

11. Training & Exercises

Exercise	Frekvence	Scope
Tabletop exercise	Čtvrtletně	IRT
Phishing simulation	Čtvrtletně	All employees
IR drill	Pololetně	IRT + IT
Full-scale exercise	Ročně	Organization-wide

12. Policy Review

Po každém incidentu: Review lessons learned
Čtvrtletně: Metrics review, process update
Ročně: Full policy review + CISO approval

Příští revize: Q2 2026