Incident response policy

Version 0.1 draft · Effective effective date

An incident is any event that may compromise the confidentiality, integrity or availability of OBMr or the information in it. A breach of security safeguards is the loss of, unauthorized access to, or unauthorized disclosure of personal information.

Roles

Anyone who suspects an incident reports it at once to security@obmr.app and the incident lead, by phone if urgent.

Steps

1. Record. Open an incident record with the time found, who found it and what was seen. Keep every note and log. Do not delete evidence.
2. Contain. Stop the harm: revoke sessions, rotate keys, disable accounts, take a feature offline. Containment comes before investigation.
3. Assess. Which organizations and people are affected, what information, whether it was personal information, and how sensitive it is.
4. Decide on real risk of significant harm. Consider the sensitivity of the information and the probability it will be misused. Significant harm includes humiliation, damage to reputation or relationships, loss of employment or professional opportunities, financial loss and identity theft.
5. Notify.

- Customers: for Customer Data, notify each affected customer's account contact without undue delay and within 72 hours of confirming the breach, with what is known, what we are doing, and a contact. Customers decide whether to notify their regulators and staff, and we give them what they need. - For information we control (our own account and website records): if there is a real risk of significant harm, report to the Office of the Privacy Commissioner of Canada and notify affected people as soon as feasible, plus any provincial regulator required, such as Quebec's Commission d'accès à l'information. Notify other organizations that could reduce the harm. - United States: follow the notification laws of each affected person's state.

1. Fix and recover. Remove the cause, restore from backup if needed (see the disaster recovery policy), and confirm the fix.
2. Review. Within 10 business days, write what happened, why, what worked, and what will change. Share a summary with affected customers.

Records

Every breach of security safeguards is recorded, whether or not it is reported, and the record is kept for at least 24 months. The record includes the date, the cause, the information and people involved, the risk assessment, and the notifications made.

Practice

The response is rehearsed at least once a year with a realistic scenario, and this policy is updated after each rehearsal and each real incident.