Politica di Risposta agli Incidenti

v1.0 · 7 maggio 2026

Rilevamento, classificazione e comunicazione degli incidenti.

This policy describes Optiviera's procedures for detecting, classifying, managing, and communicating security incidents and personal data breaches. It supports GDPR Article 33 (supervisory authority notification) and Article 34 (communication to data subjects) obligations.

Incident Classification

SeverityStatusDescriptionResponse Target

Critical (P1)CriticalPlatform outage, data breach, active exploitation< 1 hour initial response

High (P2)HighSignificant impairment, unauthorized access< 4 hours initial response

Medium (P3)MediumDegraded performance, isolated vulnerability< 24 hours initial response

Low (P4)LowMinor issues, informational vulnerabilitiesNext business day

Incident Response Process

Detection & Triage

Monitor alerts and anomaly detection
Initial severity classification
Assign incident owner
Activate response team

Containment

Isolate affected systems
Preserve evidence
Block attack vectors
Assess scope and impact

Eradication & Recovery

Remove threat or vulnerability
Restore affected services
Verify system integrity
Apply security patches

Communication & Review

Notify affected customers
Regulatory notifications where required
Post-incident review
Update security controls

Personal Data Breach Notification

Supervisory authority notified within 72 hours where feasible (GDPR Art. 33)
Customer notification without undue delay upon confirmed breach
Breach notifications include nature, scope, likely consequences, and remediation
Breach records maintained in internal incident log
Post-incident review conducted within 30 days of resolution

Reporting a Security Issue

To report a security vulnerability: [email protected]

For general incidents: [email protected]

Please include details of the issue, steps to reproduce, and your contact information. We will acknowledge receipt within 24 hours.

Torna al Centro Fiducia