Report an incident
An incident is any unplanned event that harms or threatens a Northwind or customer service, system or data. Examples include outages, data leaks, malware, lost devices and suspected phishing. This page explains how to report one. The formal procedure is SOP-001 Incident Response, version 2 (current).
What SOP-001 v2 requires
| Item | Current rule (v2) |
|---|---|
| P1 acknowledgement | Within 15 minutes, and a bridge call is opened |
| Completion | Compliance is notified when the incident is complete |
| Record retention | 7 years |
| Review of the procedure | Every 12 months |
Version 1 of SOP-001 allowed 60 minutes to acknowledge a P1 and retained records for 3 years. It is superseded; ignore any guidance that quotes 60 minutes.
How to report
- Stop and secure. If you suspect a compromise, disconnect from the network but do not power off the device.
- Report immediately. Contact the service desk (Bob Kessler, Support Lead) by phone or chat, or use the incident form on the service desk portal. For anything that looks like a security event, also email security@northwind.example.
- Say what you know: what happened, when, what systems or customers are affected, what you did.
- Stay reachable. The incident manager will contact you.
- Do not delete evidence. Keep emails, logs and files as they are.
Priority levels
| Priority | Description | Examples |
|---|---|---|
| P1 | Critical: customer-facing outage or confirmed data breach | Production down, customer data exposed |
| P2 | Major degradation | Key feature failing for many users |
| P3 | Minor issue with workaround | Single user cannot log in |
| P4 | Request or cosmetic | Question about a report |
The incident manager decides the priority. If in doubt, report it as higher; it can be lowered.
What happens after a P1 report
- The service desk acknowledges within 15 minutes and opens a bridge call.
- The incident manager assembles responders, including security (Erin Oduya) when relevant.
- Customers are informed by the account team; see Customer escalation.
- The incident is resolved and a record is written.
- Compliance is notified once the incident is complete.
- A post-incident review captures lessons.
Phishing
Do not click links or open attachments in suspicious email. Use the "Report phishing" button, and if you did click, change your password straight away, see Password manager and MFA.
Failed releases
A failed production release that affects customers is an incident; see Release process.
Backups and recovery
Daily backups are kept 35 days and restores are tested quarterly under SOP-IT-002, which helps recovery after data loss.
Owner: Bob Kessler - Last updated: 2026-06-16