Advanced Security Incident Handling – Internal SOP

🔐 Article ID: SEC-204-A

Audience: Internal Support Agents – Tier 2+
Last Updated: April 2025
Confidentiality Level: Internal Use Only

---

🧭 Purpose

This document outlines the advanced steps support agents must follow when handling potential security incidents reported by customers. This includes suspected account compromise, unauthorized access, and sensitive data exposure.

---

🚨 When to Use This SOP

Trigger this workflow when a customer reports any of the following:

• Suspicious login or account activity
• Unauthorized configuration or data changes
• Security policy enforcement failures (e.g., MFA bypass)
• Concerns over exposed or downloaded sensitive data
• Requests for incident reports or audit logs

---

✅ Prerequisites

Before proceeding:

• Confirm agent identity via secure internal login
• Ensure user reported the issue through an authenticated channel (email domain, in-app chat, secure portal)

---

🧪 Step-by-Step Procedure

🔹 Step 1: Verify Reporter and Account Context

• Look up the account and user in the CRM (ensure user role = admin)
• Confirm issue time, affected users, and systems mentioned
• Check for recent access anomalies in system audit logs (e.g., IP address, time, session type)

---

🔹 Step 2: Conduct a Quick Impact Assessment

Use internal tooling (e.g., SecAudit CLI, UserWatch, or SIEM dashboard) to check:

• Last login location/IP and timestamp
• Number of affected user sessions
• Recent changes to roles, permissions, or settings
• Download/export events involving sensitive objects (CSV exports, PHI, etc.)

Log initial findings in the ticket using this format:

🔍 SECURITY CHECK:
- Account: [CustomerName]
- Affected User: [Email]
- Last Login IP: [xxx.xxx.xxx.xxx]
- Recent Export: [Yes/No]
- Risk Rating: [Low/Medium/High]

---

🔹 Step 3: Take Protective Actions (if needed)

If the issue involves potential compromise:

• Immediately revoke session tokens via Admin Console
• Force MFA re-enrollment if 2FA integrity is in question
• Suspend account or specific user(s) if high-risk actions were taken
• Notify security team via Slack channel #sec-incidents and tag @oncall

---

🔹 Step 4: Communicate with the Customer

Use approved response templates from the Security Response Library. Avoid speculation. If a security breach is not confirmed, stick to impact-neutral language.

Examples:

• “We’ve reviewed your account and taken precautionary steps to protect your data.”
• “We’ve escalated this to our security team and will follow up within [SLA window].”

Always include the ticket ID in communications for audit purposes.

---

🔹 Step 5: Escalate for Investigation

If the issue cannot be resolved with immediate controls:

• Assign ticket to Security Team Queue
• Attach:
  • Audit log screenshots
  • Impact summary (see Step 2)
  • Timeline of customer report → agent response
• Add labels: security, potential_compromise, privileged_action

---

📦 Reference Tools

• UserWatch – Live session tracker
• SecAudit CLI – Audit log query tool
• Admin Console – For token revocation, suspension, MFA resets
• Security Response Library – Pre-approved email/chat copy

---

🧠 Tips

• Do not disclose forensic details unless approved by the security team.
• Never copy audit logs directly into tickets visible to customers.
• If unsure about the severity, err on the side of escalation.

---

🔁 Review & Follow-Up

After resolution:

• Ensure customer receives a follow-up message and optional security summary.
• Log the incident in the monthly Security Case Review Sheet.

---