An immediate call is made to the issuer and the VPA who, between them, contact law enforcement and put together a joint statement

The head of security initiates a meeting, and once the VPA approves the messaging, law enforcement is notified in two days

A report is requested by the issuer, the vendor sends it to them, and the issuer handles the incident with the local police

After an incident review, the VPA, issuer and law enforcement are all notified within 24 hours

Within the Security Control Room (SCR)

Within a room in the HSA with security controls equivalent to the SCR applied

Within the SCR or a room with equivalent security

Within the secure server room inside of the HSA

Security Assessment Questionnaire (SAQ)

Attestation of Compliance (AOC)

Report on Compliance (ROC)

Letter of Approval (LOA)

The employee must be escorted from the premises immediately

The employee's locker and desk must be searched prior to termination

The Human Resources department must be notified prior to termination

The security manager must be notified in writing prior to termination

Each visitor entering the facility must be issued and must visibly wear a disposable ID badge that identifies them as a non-employee

Each visitor entering the facility must wear their issued access badge above waist height

Badges with access-controls must not be issued to visitors

Unissued visitor access badges must be securely stored