Skip to content

Incident Response Playbook

Supports: ../policies/incident-response-policy.md. Owner: DIR (incident commander). Evidence: restricted post-mortem (Tier 2) + non-identifying entry in ../registers/incident-log.md. Ties: SEC-13, C19.

When to invoke

Any of: unauthorized access (confirmed/suspected); a personal-data breach; a lost/compromised device; a secret exposed (committed/leaked/logged); or a safety incident from the product's online→offline nature (credible stalking/harassment enabled by a weakness). When unsure, invoke — under-reacting is the costlier error.

Severity ladder

Sev Meaning Examples
SEV1 Active breach / data exposure / safety threat Personal data exfiltrated; credible stalking via a location leak; live auth bypass
SEV2 Contained or limited-impact security event Single leaked credential, rotated before use; isolated authz bug, no data accessed
SEV3 Minor / near-miss Secret committed and caught by the scan pre-merge; low-risk misconfig

Steps

  1. Declare & assign. DIR is incident commander; assign a scribe (the post-mortem owner). Start a timeline — note the awareness time; the 72-hour ICO clock starts here for any likely personal-data breach.
  2. Triage & severity. Classify SEV1–3; for SEV1 prioritize containment over investigation.
  3. Contain. Revoke affected sessions; rotate exposed secrets immediately (../policies/cryptography-and-secrets-policy.md); remove access; for a safety incident, sever the matching/messaging path between the parties.
  4. Eradicate. Find and fix root cause (the bug, the misconfig, the leaked key). Land the fix via the change process (emergency-change path if needed).
  5. Assess breach-notification duty (COUNSEL). Is a personal-data breach likely to risk individuals? If yes → ICO within 72h (Art 33). High risk to individuals → notify them without undue delay (Art 34). Proximity/travel data raises the likelihood of "high risk". Working assumption is C19; do not let the clock wait on ratification.
  6. Recover. Restore service/data from the most recent verified backup (../policies/backup-and-recovery-policy.md); reconcile any restore against erasure/retention obligations.
  7. Post-mortem (blameless). Filed in the restricted store: timeline, root cause, impact, what worked, corrective actions with owners/dates.
  8. Update the data room. Add the non-identifying summary + outcome to ../registers/incident-log.md; update any affected control rows; feed corrective actions into READINESS.md.

Roles

DIR = commander + comms. INFRA/OPS = containment/eradication/recovery. COUNSEL = notification decision. Scribe = timeline + post-mortem.

Readiness

Run a tabletop of at least one scenario (leaked credential; presence-data exposure) before private beta to validate this playbook. Until exercised, SEC-13 stays not started.