Draft Cybersecurity Incident Response Policy

Skill: Draft Cybersecurity Incident Response Policy for Public Medical Device Manufacturer

1. Subject-matter triage

• Treat the source set as a policy-drafting record, not a template exercise.
• Identify the governing mandate first; it controls scope, authority, escalation, and reporting.
• Pull out the operational state from the runbook and after-action materials before drafting any rule.
• Separate mandatory policy content from implementation notes so the policy reads as a governing instrument, not a memo.
• If the source set contains more than one facility, product line, or business unit, map the policy to each in scope before drafting the final text.
• If the source set contains only one operating context, state that the policy is limited to that context and draft accordingly.

2. Failure modes the skill is correcting

• Drafting a generic cybersecurity incident response template that ignores the organisation’s actual gaps, workflows, and governance structure.
• Treating the governing resolution or equivalent authority as background instead of the source of policy authority.
• Missing mandatory elements drawn from regulatory guidance for a regulated medical device manufacturer.
• Failing to align the policy with public-company disclosure obligations where incident materiality may trigger external reporting.
• Omitting coordination points with insurance, privacy, legal, IT, quality, regulatory, and executive functions.
• Producing a companion drafting notes memo that merely summarizes the policy instead of explaining why each provision was selected.
• Leaving open who decides, who escalates, who reports, and when each step occurs.
• Allowing incident handling to remain aspirational rather than operational, measurable, and assignable.

3. Legal frameworks / domain conventions that apply

• Medical device cybersecurity lifecycle obligations: the policy should reflect post-market security expectations, incident handling, remediation, and documentation duties applicable to regulated manufacturers.
• Public-company disclosure obligations: include a materiality assessment and escalation path for potential securities-law disclosure decisions under the applicable disclosure regime.
• Privacy and security safeguard requirements: if personal or health information may be involved, include administrative incident-response controls and breach-assessment workflow consistent with the applicable privacy/security rules.
• Recognized cybersecurity incident-response structure: organize the policy around prepare, detect, analyze, contain, eradicate, recover, and review functions, with the operative content centered on response and recovery.
• Insurance coordination rules: if the source materials reference cyber-insurance, capture notice triggers, timing, approval prerequisites, and any restrictions on response spend or vendor use.
• Governance and delegation conventions: policy authority must track the governing body or delegated officer named in the source materials and should not expand beyond that mandate.

4. Analytical scaffolds

• Read the governing mandate to extract the policy’s authority, scope, required approvers, escalation hierarchy, and any required board or executive reporting.
• Read the gap analysis to identify each missing or weak control that the policy must cure.
• Read the operational runbook and after-action material to see how incidents are actually handled and where the policy must convert practice into mandatory steps.
• Read the regulatory guidance for any required policy elements, timing expectations, documentation duties, or reporting triggers.
• Read any insurance excerpt for notice requirements, consent restrictions, and coordination obligations.
• Draft the policy as a formal governance document with clear sections for purpose, scope, definitions, roles, classification, detection, escalation, containment, communications, recovery, review, and maintenance.
• Translate every material gap into a specific rule, owner, or timing requirement rather than a general statement of intent.
• Draft the companion notes memo as a drafting rationale document that ties each major provision to a source document and explains the implementation choice.
• Where the sources imply multiple incident categories, roles, facilities, or reporting paths, enumerate them explicitly before drafting the operative rules.
• Use mandatory language for obligations and avoid aspirational phrasing unless the source documents clearly support discretion.

5. Vertical / structural / temporal relationships

• Governance mandate sets the ceiling and floor for the policy; the policy implements that authority without altering it.
• The gap analysis identifies what is missing; the policy should close each gap with a concrete requirement.
• Operational practice shows what happens in reality; the policy should formalize, correct, or constrain that practice.
• Regulatory or disclosure windows may run faster than internal approval chains; build escalation and decision points early enough to preserve compliance.
• External notifications, insurer notices, and internal leadership escalation should be sequenced so that one does not block another.
• Recovery and post-incident review should follow containment and remediation, with lessons learned feeding back into policy maintenance.

6. Output structure conventions

• Produce two deliverables: the cybersecurity incident response policy and the policy drafting notes memo.
• Draft the policy as the primary deliverable first; only then draft the notes memo.
• Make the policy a standalone instrument with operative provisions, named roles, effective-date logic, and review cycle.
• Make the notes memo concise but specific, with each major drafting choice tied to the source material that drove it.
• Use industry-conventional headings rather than a rubric-shaped list.
• Keep the policy internally usable by operations, legal, quality, and executive stakeholders.
• Ensure the final files are named exactly as instructed by the workflow and contain substantive content, not placeholders.