Política de Respuesta a Incidentes

v1.0 · 7 de mayo de 2026

Detección, clasificación y comunicación de incidentes.

This policy describes Optiviera's procedures for detecting, classifying, managing, and communicating security incidents and personal data breaches. It supports GDPR Article 33 (supervisory authority notification) and Article 34 (communication to data subjects) obligations.

Incident Classification

SeverityStatusDescriptionResponse Target

Critical (P1)CriticalPlatform outage, data breach, active exploitation< 1 hour initial response

High (P2)HighSignificant impairment, unauthorized access< 4 hours initial response

Medium (P3)MediumDegraded performance, isolated vulnerability< 24 hours initial response

Low (P4)LowMinor issues, informational vulnerabilitiesNext business day

Incident Response Process

Detection & Triage

Monitor alerts and anomaly detection
Initial severity classification
Assign incident owner
Activate response team

Containment

Isolate affected systems
Preserve evidence
Block attack vectors
Assess scope and impact

Eradication & Recovery

Remove threat or vulnerability
Restore affected services
Verify system integrity
Apply security patches

Communication & Review

Notify affected customers
Regulatory notifications where required
Post-incident review
Update security controls

Personal Data Breach Notification

Supervisory authority notified within 72 hours where feasible (GDPR Art. 33)
Customer notification without undue delay upon confirmed breach
Breach notifications include nature, scope, likely consequences, and remediation
Breach records maintained in internal incident log
Post-incident review conducted within 30 days of resolution

Reporting a Security Issue

To report a security vulnerability: [email protected]

For general incidents: [email protected]

Please include details of the issue, steps to reproduce, and your contact information. We will acknowledge receipt within 24 hours.

Volver al Centro de Confianza