{"id":4057,"date":"2023-12-11T15:51:30","date_gmt":"2023-12-11T15:51:30","guid":{"rendered":"https:\/\/api-enfance.ca\/politique-de-reponse-aux-incidents\/"},"modified":"2026-03-16T14:09:34","modified_gmt":"2026-03-16T14:09:34","slug":"it-security-incident-response-policy","status":"publish","type":"page","link":"https:\/\/api-enfance.ca\/en\/it-security-incident-response-policy\/","title":{"rendered":"IT Security Incident Response Policy"},"content":{"rendered":"

[vc_row row_height_percent=”0″ override_padding=”yes” h_padding=”2″ top_padding=”2″ bottom_padding=”2″ back_color=”color-xsdn” back_image=”3628″ back_repeat=”no-repeat” back_attachment=”fixed” back_position=”center center” overlay_color=”color-xsdn” overlay_alpha=”0″ gutter_size=”0″ column_width_percent=”100″ shift_y=”0″ z_index=”0″ uncode_shortcode_id=”171675″ back_color_type=”uncode-palette” overlay_color_type=”uncode-palette”][vc_column column_width_percent=”100″ gutter_size=”3″ back_color=”color-xsdn” overlay_alpha=”50″ radius=”std” shadow=”std” shadow_darker=”yes” shift_x=”0″ shift_y=”0″ shift_y_down=”0″ z_index=”0″ medium_width=”0″ mobile_width=”0″ width=”1\/1″ uncode_shortcode_id=”156091″ back_color_type=”uncode-palette”][vc_row_inner limit_content=””][vc_column_inner column_width_percent=”100″ align_horizontal=”align_center” gutter_size=”3″ overlay_alpha=”50″ shift_x=”0″ shift_y=”0″ shift_y_down=”0″ z_index=”0″ medium_width=”0″ mobile_width=”0″ width=”1\/1″ uncode_shortcode_id=”159367″][vc_custom_heading text_color=”color-211739″ heading_semantic=”h1″ text_size=”h1″ heading_display=”inline” uncode_shortcode_id=”809228″ text_color_type=”uncode-palette” subheading=”Approved by the API-Enfance Board of Directors on December 18, 2023.”]<\/p>\n

IT Security Incident Response Policy<\/h1>\n

[\/vc_custom_heading][\/vc_column_inner][\/vc_row_inner][vc_custom_heading text_color=”color-210211″ heading_semantic=”h3″ text_size=”h3″ uncode_shortcode_id=”156348″ text_color_type=”uncode-palette”]Purpose[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”178205″]This policy defines the requirements for reporting and responding to incidents related to the Organization’s information systems and operations. This policy applies to all Employees and Partners of the Organization, including, but not limited to, its business units and subsidiaries.[\/vc_column_text][vc_custom_heading text_color=”color-210211″ heading_semantic=”h1″ text_size=”h3″ uncode_shortcode_id=”437985″ text_color_type=”uncode-palette”]Definitions[\/vc_custom_heading][vc_row_inner limit_content=””][vc_column_inner column_width_percent=”90″ gutter_size=”2″ overlay_alpha=”50″ shift_x=”0″ shift_y=”0″ shift_y_down=”0″ z_index=”0″ medium_width=”0″ mobile_width=”0″ width=”1\/1″ uncode_shortcode_id=”180447″][vc_column_text uncode_shortcode_id=”149755″]1) Organization<\/span>
\nAPI-Enfance, a non-profit legal person incorporated under Part 3 of the Companies Act (RLRQ, c. C-38), having its head office at 1024, rue de Nou\u00eb, Quebec City (Qu\u00e9bec) G1W 4L3, registered in the Registraire des entreprises du Qu\u00e9bec under number 1175257550.<\/p>\n

Coordonn\u00e9es :
\n+1 (819) 200-0203
\ninfo@api-enfance.ca<\/p>\n

2) Employee<\/span>
\nAny person bound to the Organization by a contract of employment, in accordance with the regulations in force.<\/p>\n

3) Partner<\/span>
\nAny person not employed by API-Enfance who is contractually bound to collaborate with the Organization.<\/p>\n

4) Website<\/span>
\nRefers to the website created and developed by the Organization, accessed through the https:\/\/api-enfance.ca<\/a> domain, and redirecting users to the Web Application.<\/p>\n

5)<\/span> Web Application<\/span>
\nRefers to the application software hosted on a server and accessed via a web browser created and developed by the Organization and supporting the Blooming Words\u2122 program, including the improvements. The use of the Web Application does not require installation on any physical computer hardware.<\/p>\n

The Web Application includes the following elements:<\/p>\n

– https:\/\/app.api-enfance.ca<\/span> domain and all related applications,
\n– User Management Module (Dashboard),
\n– Training Modules,
\n– Technical Support Module.<\/p>\n

6) Password<\/span>
\nAn arbitrary string of characters chosen by a User, used to authenticate him when he attempts to log in, in order to prevent unauthorized access to his account.<\/p>\n

7) IT Manager<\/span>
\nAn employee or partner responsible for managing the Organization’s multi-user computing environment. The IT department manager is usually responsible for installing and configuring system hardware and software, creating and managing User accounts, upgrading software, as well as backup and recovery tasks.<\/p>\n

8) User<\/span>
\nMeans any person required to use the Web Application, or any person browsing the Site.<\/p>\n

9) Legal Advisor<\/span>
\nA person identified by senior management as the point of contact for legal matters.<\/p>\n

10) Executive Management<\/span>
\nIncludes Executive Director and Deputy Director(s).<\/p>\n

11) Designated Persons and Designated Channels<\/span>
\nIf you have any questions, or if you have an incident, please contact privacy@api-enfance.ca<\/a>. It is also possible to write to the Organization by post at the above address.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_custom_heading text_color=”color-210211″ heading_semantic=”h3″ text_size=”h3″ uncode_shortcode_id=”882101″ text_color_type=”uncode-palette”]Policy[\/vc_custom_heading][vc_row_inner limit_content=””][vc_column_inner column_width_percent=”90″ gutter_size=”0″ overlay_alpha=”50″ shift_x=”0″ shift_y=”0″ shift_y_down=”0″ z_index=”0″ medium_width=”0″ mobile_width=”0″ width=”1\/1″ uncode_shortcode_id=”108326″ css=”.vc_custom_1696499849356{padding-bottom: 15px !important;}”][vc_custom_heading text_color=”color-606832″ heading_semantic=”h5″ text_size=”h5″ uncode_shortcode_id=”195781″ text_color_type=”uncode-palette”]1) Preface[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”608580″ css=”.vc_custom_1720689839315{padding-top: 15px !important;}”]This policy includes roles, responsibilities and communication strategies in the event of a compromise, including notification of relevant external partners.<\/p>\n

Specific areas addressed in the policy include:<\/p>\n

– Incident response procedure,
\n– Resolution and business continuity,
\n– Data backup process,
\n– Analysis of legal incident reporting requirements,
\n– Identification and protection of all critical system components,
\n– Reference to incident response procedures of relevant partners.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner limit_content=””][vc_column_inner column_width_percent=”90″ gutter_size=”3″ overlay_alpha=”50″ shift_x=”0″ shift_y=”0″ shift_y_down=”0″ z_index=”0″ medium_width=”0″ mobile_width=”0″ width=”1\/1″ uncode_shortcode_id=”194236″][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”435399″ text_color_type=”uncode-palette”]2) IT Security Response Team[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”147542″ css=”.vc_custom_1720702741114{padding-bottom: 15px !important;}”]Creation of the Response Team<\/strong><\/p>\n

The Organization’s Executive Management must organize and maintain a Computer Security Response Team, or be in contact with a third-party security response service provider, capable of providing expedited problem notification, damage control and problem correction services in the event of computer-related emergencies, such as virus infestations and hacker intrusions.<\/p>\n

Response Team Responsibilities<\/strong><\/p>\n

The IT Security Response Team must develop, periodically update and regularly test emergency response plans that provide for the continued operation of critical IT and communications systems in the event of service interruption or degradation.<\/p>\n

Response Team Availability<\/strong><\/p>\n

The Organization’s IT Security Response Team must always be available to respond to alerts including, but not limited to, evidence of unauthorized activity, detection of unauthorized wireless access points, critical intrusion detection alerts and reports of unauthorized modifications to critical systems or content files.<\/p>\n

[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”192943″ text_color_type=”uncode-palette”]3) Roles and Responsibilities[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”152519″ css=”.vc_custom_1720703953319{padding-bottom: 15px !important;}”]Incident Management<\/strong><\/p>\n

The members of the IT Security Response Team must be clearly defined by Executive Management. These individuals must be given the authority to define the procedures and methodologies that will be used to manage specific security incidents.<\/p>\n

Designated Person for All Security Events<\/strong><\/p>\n

Unless they are expressly recognized as authorized spokespersons for the Organization, no Employee may speak to the press or any other external party about the current status of an emergency situation or a recently experienced security incident.<\/p>\n

Information for Legal Proceedings<\/strong><\/p>\n

Employees or Partners are prohibited from providing Agency records, or copies thereof, to outside third parties or government officials, whether in response to a subpoena or otherwise, unless they have obtained prior authorization from the Organization’s Executive Management. Similarly, Employees are prohibited from testifying about facts that come to their knowledge in the course of their official duties, unless they have obtained prior authorization from the Organization’s Executive Management.<\/p>\n

Password Management and Two-factor Authentication<\/strong><\/p>\n

To prevent unintentional disclosure of sensitive information, Employees and Partners of the Organization must use a password manager approved by the IT Manager. Passwords must contain a minimum of 11 alphanumeric characters and include at least one special character.<\/p>\n

In addition, the Organization’s Employees and Partners must activate and use, where possible, a two-factor authentication (2FA) system on all software, applications, the web application or any other system or software enabling access to Users’ personal data. 2FA is also required for the Organization.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”126115″ text_color_type=”uncode-palette”]4) Incident Response[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”421460″ css=”.vc_custom_1720703401455{padding-bottom: 15px !important;}”]Intrusion Response<\/strong><\/p>\n

The IT department manager must document and periodically review intrusion response procedures. These procedures should include the sequence of actions that the Organization’s Employees and Partners should follow in the event of a suspected intrusion into the information system, who has the authority to perform which actions in response, and what resources are available to assist in the response. All Employees and Partners required to follow these procedures must be periodically trained and familiarized with them.<\/p>\n

Resolution of Information Security Incidents<\/strong><\/p>\n

All information security incidents must be handled with the participation and cooperation of the IT Security Response Team.<\/p>\n

Security Modifications After System Compromise<\/strong><\/p>\n

Whenever a system has been compromised, or is suspected of having been compromised by an unauthorized party, the IT Manager must immediately have a reliable version of the operating system and all security-related software reloaded, and all recent changes to permissions and access must be examined for possible unauthorized modifications.<\/p>\n

Suspected System Intrusions<\/strong><\/p>\n

Whenever a system is suspected of having been compromised, the computer concerned must be immediately disconnected from all networks, and predetermined procedures must be followed to ensure that the system is free from compromise before it is reconnected to the network.<\/p>\n

Unauthorized Access Problems<\/strong><\/p>\n

Whenever unauthorized access to the system is suspected or proven, the Organization’s Employees or Partners must take immediate action to stop such access, or request assistance from the IT Manager.<\/p>\n

Confidentiality of Internal Investigations<\/strong><\/p>\n

Until charges are laid or disciplinary action taken, all investigations into allegations of criminal or abusive behavior must be kept strictly confidential in order to preserve the reputation of the suspected party.<\/p>\n

Participation in Legal Proceedings<\/strong><\/p>\n

Any Employee or Partner of the Organization summoned by subpoena or otherwise before a judicial board or government agency, in connection with services provided by the Organization, must immediately notify the Organization’s Legal Counsel and Executive Management in writing.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”344326″ text_color_type=”uncode-palette”]5) Monitoring and Recording the Use of Shared Resources[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”199124″ css=”.vc_custom_1720703901418{padding-bottom: 15px !important;}”]The use of all the Organization’s shared IT resources used for production activities must be continuously monitored and recorded. This usage history data must then be provided in real time to security alert systems designated by the IT Manager (intrusion detection systems, virus detection systems, spam detection systems, etc.).[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”206527″ text_color_type=”uncode-palette”]6) Reporting Incidents[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”458688″ css=”.vc_custom_1720703888801{padding-bottom: 15px !important;}”]Incident Report<\/strong><\/p>\n

All suspected information security incidents should be reported as quickly as possible via the Organization’s designated Communication Channel.<\/p>\n

Information Security Alert Systemn<\/strong><\/p>\n

The IT Manager shall establish, maintain and periodically test a communication system enabling the Organization’s Employees and Partners to promptly report any suspected information security problems to the appropriate staff members.<\/p>\n

Reporting Alternatives<\/strong><\/p>\n

The Organization’s Employees may also immediately report all suspected information security issues, vulnerabilities and incidents to their line manager.<\/p>\n

Whistleblower Protection<\/strong><\/p>\n

The Organization will protect Employees who report in good faith what they believe to be violations of laws or regulations, or conditions that may endanger the health or safety of other Employees. This means that such Employees will not be dismissed, threatened or discriminated against because they report what they consider to be wrongdoing or a dangerous situation.<\/p>\n

Employees who report a security problem, vulnerability or situation contrary to the Organization’s Code of Ethics to the IT Manager may, at their sole discretion, have their identity kept strictly confidential. This means that the whistle-blower’s identity will not be revealed to his or her line manager, to other members of General Management, or to other employees of the Organization who are not directly involved in the receipt of the report.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”129251″ text_color_type=”uncode-palette”]7) Events to Report[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”203700″ css=”.vc_custom_1720704028721{padding-bottom: 15px !important;}”]Damage and Loss of Off-site Systems<\/strong><\/p>\n

Employees must report immediately to their line manager and to the IT Manager any damage or loss of hardware, software or Organization’s information entrusted to them.<\/p>\n

System Alerts and Warnings<\/strong><\/p>\n

Employees and Partners must promptly report all security alerts, warnings, suspected vulnerabilities and the like to the Technical Support Department. Employees and Partners are prohibited from using the Organization’s systems to transmit such information to others, whether internal or external to the Organization.<\/p>\n

Unauthorized Activities<\/strong><\/p>\n

Employees and Partners must immediately report any unauthorized loss or modification of computerized production data to the IT Manager. Any suspicious use of files, databases or communication networks must also be reported immediately to the IT Manager.<\/p>\n

Unexpected Requests for Login Information<\/strong><\/p>\n

Apart from the regular and expected login screens, Users should be wary of all pop-ups, websites, instant messages and other requests for API-Enfance usernames and passwords. Users who encounter such requests should refrain from providing their API-Enfance username and password, and promptly report the circumstances to Technical Support.<\/p>\n

Unintentional Disclosure of Sensitive Information<\/strong><\/p>\n

Unintentional disclosure of the Organization’s sensitive information is a serious matter and must be reported immediately to both the Executive Management and the Security Committee of the Organization’s Board of Directors. Such reporting must take place as soon as the disclosure is known, or as soon as there are reasonable grounds to believe that a disclosure has taken place.<\/p>\n

Software Malfunctions<\/strong><\/p>\n

All apparent software malfunctions must be reported immediately to Executive Management or IT Manager.<\/p>\n

Unauthorized Wireless Access Points<\/strong><\/p>\n

If an unauthorized wireless access point is detected on the API-Enfance network, the IT Security Response Team must be informed.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”184117″ text_color_type=”uncode-palette”]8) Reporting to Third Parties[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”181590″ css=”.vc_custom_1720703799905{padding-bottom: 15px !important;}”]External Breach Report<\/strong><\/p>\n

Unless required by law or regulation to report information security breaches to external authorities, Executive Management, in collaboration with Legal Counsel (or his or her designee) and the IT Security Response Team must evaluate the advantages and disadvantages of external disclosure before reporting such breaches.<\/p>\n

Reporting Suspected Security Breaches to Third Parties<\/strong><\/p>\n

If a verifiable information systems security problem, or a suspected but probable problem, has resulted in the exposure of third-party private or confidential information to unauthorized persons, these third parties must be informed of the situation immediately (within three calendar days). Appendix D provides a sample letter that can be used to communicate.<\/p>\n

Loss or Disclosure of Sensitive Information<\/strong><\/p>\n

If sensitive information is lost or disclosed to unauthorized parties, or if it is suspected that it has been lost or disclosed to unauthorized parties, the owner of the information and the IT Manager must be informed immediately (within three calendar days).<\/p>\n

Exploitation of System Vulnerabilities and Victim Information<\/strong><\/p>\n

Organization’s Employees and Partners must not publicly disclose information about individuals, organizations or specific systems that have been damaged by computer crime and abuse. Similarly, the specific methods used to exploit certain system vulnerabilities must not be publicly disclosed.<\/p>\n

Disclosure of Supplier Vulnerabilities<\/strong><\/p>\n

If the Organization’s Employees or Partners discover a serious vulnerability in an information system, and that vulnerability can be directly attributed to a weakness in the hardware and\/or software of a certain supplier, that supplier must be promptly and confidentially informed of the problem by the IT Manager.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”200636″ text_color_type=”uncode-palette”]9) Contacting the Authorities[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”211352″ css=”.vc_custom_1720704113387{padding-bottom: 15px !important;}”]Contacts with Law Enforcement Agencies and the Criminal Justice System<\/strong><\/p>\n

Every decision concerning the involvement of law enforcement agencies in information security incidents or problems must be taken by the Organization’s Executive Management. Similarly, any contact informing law enforcement agencies of an information security incident or problem must be initiated by the IT Manager.<\/p>\n

Thus, the IT Manager and his staff must not contact the police or other members of the justice system about information systems problems, unless they have received written authorization from the Organization’s Executive Management.<\/p>\n

Cooperation Request in Investigations<\/strong><\/p>\n

The Organization’s Employees and Partners must immediately report any request to participate in an information security investigation to Legal Counsel. Any form of cooperation with the requester is prohibited until Legal Counsel determines that participation is lawful, unlikely to cause problems for the Organization and requested by an authorized party.<\/p>\n

Thus, even if the requester claims to be a member of law enforcement, the Organization’s Employees and Partners must not disclose any of the Organization’s internal information through any communication mechanism, unless Legal Counsel has established the authenticity of the person’s identity and the legitimacy of the request.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”112932″ text_color_type=”uncode-palette”]10) Handling Data Breaches[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”938797″]Data Breach Response Procedure<\/strong><\/p>\n

The Organization’s Executive Management in collaboration with the IT Security Response Team shall prepare, test and annually update a Data Breach Response Procedure that addresses cases of breach of Users’ sensitive data.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”606040″ text_color_type=”uncode-palette”]11) Incident Review[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”936487″]Continuous Improvement of IT Security Incident Response Procedure<\/strong><\/p>\n

The IT security incident response procedure must be updated to reflect lessons learned from actual incidents.<\/p>\n

The IT security incident response procedure must also be updated to reflect industry developments.<\/p>\n

Incident Records<\/strong><\/p>\n

The IT Manager is responsible for establishing and maintaining an incident logging process to record all incidents experienced by the Organization.<\/p>\n

Incident Feedback<\/strong><\/p>\n

The IT Manager must prepare an annual retro-analysis of reported information security incidents and data breaches.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”207544″ text_color_type=”uncode-palette”]12) Gathering Evidence[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”169625″]Evidence of Computer Crime or Abuse<\/strong><\/p>\n

To provide evidence for investigation, prosecution and disciplinary action, certain information must be collected immediately when computer crime or abuse is suspected. Information to be collected immediately includes the current system configuration as well as backup copies of all files potentially involved.<\/p>\n

Evidence Storage<\/strong><\/p>\n

Information relevant to the IT investigation should then be stored securely offline by the IT Manager until it is handed over to another authorized person, or until Legal Counsel determines that the Organization will no longer need the information.<\/p>\n

Sources of Digital Evidence<\/strong><\/p>\n

For each production IT system, the IT Manager must identify sources of digital evidence that could reasonably be used in a court case. These sources of evidence must then be subject to a standardized collection, retention and destruction process comparable to that used for essential documents.<\/p>\n

Responsibility for the Production of Digital Evidence<\/strong><\/p>\n

The Organization’s Executive Management delegates to the IT Manager the responsibility for coordinating the discovery and presentation of digital evidence that may be required to support litigation.<\/p>\n

Classification of Evidence<\/strong><\/p>\n

Agency data that may be considered electronic evidence shall be classified as CONFIDENTIAL and shall only be accessed by authorized representatives of the IT Security Response Team or approved third parties involved in the investigation.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”166613″ text_color_type=”uncode-palette”]13) Criminal Investigation[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”670791″]IT Crime Investigation<\/strong><\/p>\n

Whenever the evidence clearly shows that the Organization has been the victim of a IT or communications crime, a thorough investigation must be carried out. This investigation must provide sufficient information for the Executive Management to take action to ensure that (1) such incidents do not recur in the future, and (2) effective security measures have been re-established.<\/p>\n

Forensic Analysis Process<\/strong><\/p>\n

Any analysis or investigation using data storage media containing information that could at some point become important evidence in a trial for computer crime or computer abuse must be carried out using a copy rather than the original version. This will help prevent any unforeseen changes to the original information.<\/p>\n

Investigation Status Reports<\/strong><\/p>\n

The status of information security investigations is to be reported to the Organization only by the lead investigator or management representative of the investigation team.<\/p>\n

Information on IT Crime Investigations<\/strong><\/p>\n

All evidence, ideas and hypotheses concerning IT crimes suffered by the Organization, including possible methods of attack and the intentions of the perpetrators, must be communicated to Legal Counsel and considered restricted and confidential information protected by law.<\/p>\n

Information Security Investigations<\/strong><\/p>\n

All internal Organization investigations of information security incidents, violations and problems shall be conducted by the IT Manager.<\/p>\n

Information Security Investigation Team<\/strong><\/p>\n

Any person who knows the suspects personally, or who maintains friendly relations with them, for reasons of conflict of interest, is excluded from participation in an information security incident investigation team.<\/p>\n

Details of Incident Investigations<\/strong><\/p>\n

Details of ongoing information systems incident investigations must not be sent by e-mail. Similarly, to prevent such information falling into the hands of intruders, files describing an investigation in progress should not be stored on potentially compromised systems, or anywhere on an associated network where they could reasonably be accessed by intruders.[\/vc_column_text][vc_custom_heading text_color=”color-606832″ heading_semantic=”h3″ text_size=”h5″ uncode_shortcode_id=”162181″ text_color_type=”uncode-palette”]14) Violations[\/vc_custom_heading][vc_column_text uncode_shortcode_id=”126918″]Any violation of this policy may result in disciplinary action, including dismissal. The Organization reserves the right to report any illegal activity to the appropriate authorities and to cooperate in any investigation of such activity. The Organization does not consider conduct in violation of this policy to be a normal part of an Employee’s or Partner’s business, or a direct consequence of the performance of their duties. Accordingly, to the extent permitted by law, the Organization reserves the right not to defend or pay damages awarded to Employees or Partners resulting from a violation of this policy.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_custom_heading text_color=”color-210211″ heading_semantic=”h3″ text_size=”h3″ uncode_shortcode_id=”360319″ text_color_type=”uncode-palette”]Appendices[\/vc_custom_heading][vc_accordion][vc_accordion_tab gutter_size=”2″ column_padding=”2″ title=”Appendix A – Summary Incident Report” tab_id=”1702502643-1-30″][vc_single_image media=”6857″ media_width_percent=”80″ uncode_shortcode_id=”114724″][\/vc_accordion_tab][vc_accordion_tab gutter_size=”2″ column_padding=”2″ title=”Appendix B – Process Improvement Plan” tab_id=”1702502643-2-28″][vc_single_image media=”6854″ media_width_percent=”80″ uncode_shortcode_id=”615724″ media_link=”url:https%3A%2F%2Fapi-enfance.ca%2Fwp-content%2Fuploads%2F2023%2F12%2FANNEXE-B-Plan-damelioration-des-processus.pdf”][\/vc_accordion_tab][vc_accordion_tab gutter_size=”2″ column_padding=”2″ title=”Appendix C – Incident Log” tab_id=”1702503238417-3-10″][vc_single_image media=”6851″ media_width_percent=”80″ uncode_shortcode_id=”169808″][\/vc_accordion_tab][vc_accordion_tab gutter_size=”2″ column_padding=”2″ title=”Appendix D \u2013 Template letters to users” tab_id=”1702504361313-4-7″][vc_single_image media=”6848″ media_width_percent=”80″ uncode_shortcode_id=”737121″][\/vc_accordion_tab][vc_accordion_tab gutter_size=”2″ column_padding=”2″ title=”Appendix E – Incident Response Procedure” tab_id=”1702504411506-5-1″][vc_single_image media=”6835″ media_width_percent=”100″ uncode_shortcode_id=”210672″ media_link=”url:https%3A%2F%2Fapi-enfance.ca%2Fwp-content%2Fuploads%2F2023%2F12%2FAnnexe-E-Procedure-de-reponse-aux-incidents-scaled.jpg”][\/vc_accordion_tab][\/vc_accordion][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

[vc_row row_height_percent=”0″ override_padding=”yes” h_padding=”2″ top_padding=”2″ bottom_padding=”2″ back_color=”color-xsdn” back_image=”3628″ back_repeat=”no-repeat” back_attachment=”fixed” back_position=”center center” overlay_color=”color-xsdn” overlay_alpha=”0″ gutter_size=”0″ column_width_percent=”100″ shift_y=”0″ z_index=”0″ uncode_shortcode_id=”171675″ back_color_type=”uncode-palette” […]<\/p>\n","protected":false},"author":597,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-4057","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/pages\/4057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/users\/597"}],"replies":[{"embeddable":true,"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/comments?post=4057"}],"version-history":[{"count":40,"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/pages\/4057\/revisions"}],"predecessor-version":[{"id":6860,"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/pages\/4057\/revisions\/6860"}],"wp:attachment":[{"href":"https:\/\/api-enfance.ca\/en\/wp-json\/wp\/v2\/media?parent=4057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}