From detection to notification and post-incident review: phases, roles and timelines.
01Phases
| Phase | What happens |
|---|---|
| 1. Detect | Alarms, the external probe, log review, a customer or researcher report. |
| 2. Triage | Severity is set (critical, high, medium, low) and an incident lead is named. |
| 3. Contain | Revoke sessions or keys, close a route or a port, isolate a host. Every containment step is a change that can be reverted. |
| 4. Eradicate | Fix the root cause in code or configuration through the normal pull-request flow, with a test that keeps it fixed. |
| 5. Recover | Restore service following the Backup and Recovery Policy and confirm in production. |
| 6. Learn | A written review: timeline, root cause, what detected it, and the controls added. |
02Notification
- Affected customers are notified without undue delay once a personal data breach is confirmed, with the information they need to meet their own 72-hour GDPR notification duty.
- The notification describes what happened, which data and participants are affected, what has been done and what the customer should do.
- Updates continue until the incident is closed.
03Tooling
Session revocation for every user, credential rotation runbooks that list each consumer of a secret, CloudTrail and CloudWatch for forensics, and infrastructure code that can rebuild a host from a known-good template.
04Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.