S6 Department – Incident Reporting and Escalation Procedures

This is the Document Release Information
Article Number:	7CAV-S6-007
Scope:	S6 Department – Incident Reporting and Escalation Procedures
Version:	Version 1.1
Effective Date:	06SEP26
Last Modified Date:	06SEP26
Approving Authority:	S6 1IC
Point of Contact:	S6 2IC

Purpose and Scope

This Standard Operating Procedure establishes how suspected or confirmed security and information-system incidents are reported, reviewed, contained, documented, escalated, and resolved.

It applies to all S6 personnel and all incidents involving systems, services, accounts, access, or information administered by S6.

Reportable Incidents

Reportable incidents include suspected or confirmed:

• Account or credential compromise.
• Unauthorized access or misuse of privileges.
• Exposure, loss, alteration, or unauthorized disclosure of Regimental data.
• Malware, malicious code, or unauthorized software.
• Circumvention or failure of a security control.
• Suspicious activity affecting the availability or integrity of a system.
• Any other event that may create a material security or operational risk.

Routine support requests and service issues without a suspected security component should use the normal S6 ticket categories.

Reporting Channel and Urgent Notification

Incidents must be reported through the designated restricted Incident/Security Report ticket category.

Access to an incident ticket must be limited to:

• The requester.
• The S6 1IC and S6 2IC.
• Authorized S6 Headquarters personnel.
• Assigned responders.

An incident submitted through a general ticket category must be transferred or recreated in the restricted category. Sensitive details must be removed from the general ticket when practical.

A report must use Immediate Action Required priority when it involves an active compromise, continuing unauthorized access, serious data exposure, or substantial operational disruption.

For an Immediate Action Required incident, the reporter must also notify the S6 1IC and S6 2IC through private message. The private message supplements the ticket and does not replace it.

The normal reporting chain does not prevent direct notification to S6 Headquarters when an incident is urgent or sensitive.

Report Information and Credentials

The incident report should include, when known:

• What occurred or was observed.
• When it occurred or was discovered.
• The affected systems, services, accounts, or users.
• Known or suspected impact.
• Actions already taken.
• Relevant logs, screenshots, or other evidence.

Passwords, authentication codes, recovery codes, access tokens, private keys, and other credentials must never be included in the ticket.

If a credential may be compromised, report the type of credential and affected account without providing the credential itself.

Initial Review and Assignment

S6 Headquarters must review the report, restrict access as necessary, assign appropriate responders, and classify it as:

• Suspected Incident: Available information indicates a possible incident requiring investigation.
• Confirmed Incident: Available information confirms a security or information-system incident.
• Non-Incident: The report does not involve a security incident and may be closed or routed through the normal support process.

The initial review must identify the apparent impact, urgency, affected systems, and immediate action required.

S6 Headquarters may notify or involve additional Regimental authorities when the incident exceeds S6's responsibility or authority.

Containment and Response

Only authorized personnel may investigate or respond to an incident.

Responders must:

• Take only the action necessary to limit harm and restore control.
• Preserve relevant logs, records, and other evidence.
• Avoid unnecessary changes that could destroy evidence or increase impact.
• Document actions and material findings in the restricted incident ticket.
• Escalate when the response exceeds their ability, access, responsibility, or authority.

When delay would increase the harm, an assigned responder may take the minimum containment action permitted by their existing authority and access. S6 Headquarters must be notified immediately, and the action must be documented as soon as practical.

Access restriction or suspension must follow 7CAV-S6-004 (Access Management Procedures).

System changes required for containment or recovery must follow 7CAV-S6-006 (Change Management Procedures), including its emergency-change provisions when applicable.

Documentation and Confidentiality

The restricted incident ticket is the authoritative record of the incident.

The record must include relevant reports, actions, decisions, findings, communications, recovery work, and final outcome.

Access must be limited to personnel with an operational need to know. Incident information must not be copied into general tickets, public channels, or unrelated records.

When a secondary ticket or work record is required, it must contain only the minimum information necessary and reference the restricted incident record without disclosing sensitive details.

Recovery and Resolution

Before an incident is marked Resolved, S6 Headquarters or the assigned responder must confirm that:

• The immediate threat or unauthorized access has been contained.
• Affected access, systems, or services have been restored or secured.
• Required validation has been completed.
• Known follow-up work has been documented and assigned.
• The requester and appropriate stakeholders have been notified when permitted.

Requester communication and ticket-status handling must follow 7CAV-S6-005 (Ticket Handling Procedures) unless confidentiality or incident-response needs require otherwise.

A ticket may be marked Closed when the report is duplicated, invalid, submitted in error, or classified as a Non-Incident and routed elsewhere.

Requester inactivity must not be used to resolve or close an active incident when S6 has enough information to continue containment, investigation, or recovery.

Post-Incident Review

S6 Headquarters must conduct a post-incident review when an incident is significant, recurring, or identifies a material procedural weakness.

The review should identify:

• What occurred and its impact.
• The cause or contributing conditions, when known.
• Actions taken and their effectiveness.
• Required corrective work.
• Required policy, procedure, access, or documentation changes.

Follow-up work must be assigned and tracked through the appropriate authorized record.

This SOP must be applied with 7CAV-S6-005 (Ticket Handling Procedures), 7CAV-S6-004 (Access Management Procedures), 7CAV-S6-006 (Change Management Procedures), and 7CAV-S6-002 (Acceptable Use Policy).