Incident Response Plan Overview 

Purpose 

This document provides a brief overview of the Incident Response Plan and offers guidance for employees or incident responders who believe they have discovered or are responding to a security incident. 

Scope 

The Incident Response Plan applies to all parties that access AC Transit information (e.g., employees, contractors, third-party, and Managed Service Providers). This plan covers all information systems, applications, and data owned, operated, or managed by AC Transit. 

Incident Response Process 

AC Transit executes the Incident Response Plan within the seven phases of Incident Response: Detection, Notification, Analysis, Containment, Eradication, Recovery, and Post Incident Activity. 

Incident Reporting & Documentation 

Reporting 

• Upon discovering an issue (e.g., vulnerability/threat), contact AC Transit:  
• Insert Contact Form 

Reports should include specific details about what has been observed or discovered. 

Documentation 

All reported security events, incidents, and response activities shall be logged, assigned a severity level (low/medium, high, or critical), backed up, and saved. 

Severity 

Low 

• Issues meeting this severity have a minor impact on a small portion of the enterprise.  
• Action Timeline: Within 24 hours 

Medium 

• Issues meeting this severity have some impact on a small portion of the enterprise.  
• Action Timeline: Within 4 hours 

High 

• Issues meeting this severity involve the loss of a major service within the enterprise.  
• Action Timeline: Immediately 

Severe 

• Issues meeting this severity have an extreme impact on the enterprise.  
• Action Timeline: Immediately 

Incident Response Process 

For critical issues, the response team will follow a rigorous response process designed to investigate, contain exploitation, eradicate the threat, recover system and services, remediate vulnerabilities, and document a post-incident review, cataloging the lessons learned to avoid similar issues in the future. 

Summary 

• Event reported 
• Triage and analysis 
• Investigation 
• Containment & neutralization (short term work) 
• Recovery & vulnerability remediation 
• Hardening & Detection improvements (lessons learned, long term work) 
• promptly and properly notify customers, partners, users, affected parties, and regulatory agencies of relevant incidents or breaches in accordance with AC Transit policies, contractual commitments, and regulatory requirements. 

Roles & Responsibilities 

Every employee and user of any AC Transit information resources has responsibilities toward the protection of the information assets. The table below establishes the specific teams included in the Incident Response Team: 

Chief Information Officer	Chief Information Security Officer
Vice President of Human Resources	Affected system or operations representative(s)
Legal Counsel	Marketing
Senior Management (General Manager)	Public Relations
Chief Financial Officer (CFO)	IT Manager
Chief Operations Officer (COO)	Call Center/Operations Control Center operations
Internal Investigator(s)	Any other person(s)/entity deemed appropriate

Management Commitment 

AC Transit management is committed to providing the resources, tools and training needed to reasonably respond to identified security events and incidents with the potential to adversely affect the company and/or its customers. 

Violations & Enforcement 

Any known violations of this policy should be reported to the IT Manager. Violations of this policy may result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment. 

Version 

Version	Description	Date	Author	Approved By
1.0	First Version	2/15/2024	IT Department	CIO