~6-page information security policy template on incident management.
 
Information security incidents must be reported, managed and resolved professionally and efficiently.  Important lessons must be drawn out and learnt, prompting improvements to reduce the possibility and/or impacts of similar incidents occurring again.  This important, detailed policy lays out key aspects of incident management and the corresponding responsibilities.
 
Note: a specific $ value in the policy template determines whether an incident qualifies as 'significant' and therefore should be treated differently from lesser incidents (e.g. they need to be escalated): management should determine and specify the appropriate threshold value, or find another way to ensure greater attention is paid to more significant incidents.
 
Note: there is a separate template for incident reporting, since these two policies have distinct audiences.  
 
Supplied as an MS Word document, readily customised for your organisation's specific situation.