Incident Response & Security Reporting Policy

[- Alex - 36]

Incident Response & Security Reporting Policy
Security, Outages & Evidence Preservation
This guide may be updated as GGU policies, procedures, platforms, and organizational needs change.

Public Transparency:
This policy is intentionally published for community transparency. The policy itself is public; credentials, recovery material, private personnel records, security-sensitive evidence, and other protected operational details remain restricted.

 

Report Immediately

• Compromised accounts
• Exposed credentials
• Unauthorized access
• Data loss
• Major outages
• Malicious administrative changes
• Serious vulnerabilities

 

Preservation

Preserve logs and evidence. Do not delete or alter records to conceal mistakes.

 

Containment

Restrict access or isolate systems when necessary to stop active harm.

 

Post-Incident

Significant incidents should receive a documented review and follow-up actions.

 

Scope

This policy applies to GGU members, Leadership, contributors, partners, or systems to the extent they participate in or affect the activity described by this policy.

 

Responsibilities

• Individuals are responsible for complying with the policy within their assigned access and duties.
• Managers are responsible for communicating expectations and correcting known violations within their area.
• Higher Leadership may interpret organization-wide questions, approve exceptions, or impose additional controls where risk requires it.

 

Exceptions

Exceptions should be limited, justified by a legitimate operational need, approved by the appropriate authority, and documented when they materially increase risk or depart from normal practice.

 

Violations

Violations may result in corrective instruction, removal of access, warning, suspension, demotion, removal from Leadership, removal from the community, or other action appropriate to the severity and circumstances.

 

Review & Maintenance

This policy should be reviewed when relevant systems, laws, platforms, organizational structure, or operational practices materially change.

 

Reporting Channel

Security-sensitive incidents should be reported through a restricted Leadership or technical channel rather than public Discord channels.

 

Do Not Conceal

Mistakes must be reported promptly. Concealing an incident, deleting logs, or falsifying the timeline is itself a serious policy violation.

 

Definitions & Interpretation

Where a term is not specifically defined in this policy, it should be interpreted using its ordinary GGU operational meaning and related published guides. When two policies appear to conflict, the more specific policy should generally control for its subject matter unless higher Leadership directs otherwise.

 

Policy Ownership

Each policy should have an identifiable organizational owner responsible for periodic review, proposed updates, and resolving routine interpretation questions. Ownership of the policy does not grant unlimited authority to waive it.

 

Records & Evidence

• Keep records that are reasonably necessary to demonstrate approvals, access changes, disciplinary actions, incidents, or exceptions.
• Store sensitive records in appropriately restricted locations.
• Do not create unnecessary collections of personal information.
• Do not alter or delete records to conceal mistakes or avoid review.
• Where an action is logged automatically, preserve the relevant log rather than duplicating it manually without need.

 

Good-Faith Reporting

Members and Leaders should be able to report suspected policy violations in good faith without retaliation. Knowingly false reports, fabricated evidence, or malicious misuse of reporting processes may themselves be addressed as misconduct.

 

Policy Changes

Material policy changes should be communicated to affected people. Changes that alter access, enforcement, or Leadership obligations should include enough explanation for people to understand what changed and when the new expectation applies.

 

Severity & Notification

Incidents with broad service impact, administrative compromise, exposed secrets, or suspected unauthorized access should be escalated quickly to technical and organizational Leadership. Routine single-service errors can remain within the responsible Team unless the impact expands.

 

Policy protects the community when expectations are clear before problems happen.