Incident Management & Response Policy

Purpose

This policy establishes procedures for detecting, responding to, and recovering from security incidents affecting the Close-Rate platform. The goal is to minimize damage, reduce recovery time, communicate transparently with affected parties, and prevent recurrence.

Incident Classification

• Severity 1 (Critical): Confirmed data breach, unauthorized access to customer data, complete service outage, compromised credentials. Response: Immediate — all hands.

• Severity 2 (High): Partial service degradation affecting customers, suspected unauthorized access, failed authentication systems. Response: Within 1 hour.

• Severity 3 (Medium): Single-customer impact, integration failures, non-critical service degradation. Response: Within 4 hours during business hours.

• Severity 4 (Low): Minor issues, cosmetic bugs, non-impacting anomalies. Response: Next business day.

Incident Response Team

• Incident Commander: Brian Paulson (CEO / Technical Lead) — owns communication and decision authority

• Engineering Lead: Responsible for technical investigation, containment, and remediation

• Customer Success: Responsible for customer communication if any customer data is affected

Contact: client-services@close-rate.com for all incident reports.

Response Procedures

1. Detection & Triage

• Incidents may be detected via application logs (AWS CloudWatch), customer reports, automated alerts, or third-party notifications

• The person who identifies the incident records initial details: what happened, when, what systems are affected

• Incident Commander assigns a severity level and assembles the response team

2. Containment

• Isolate affected systems to prevent further damage

• Revoke compromised credentials immediately (API keys, OAuth tokens, access keys)

• If customer data is at risk, disable affected features or endpoints

• Preserve logs and evidence for investigation

3. Investigation

• Determine root cause and full scope of the incident

• Identify which customers, data, and systems were affected

• Review AWS CloudWatch logs, application logs, and database audit trails

• Document timeline of events

4. Remediation

• Apply fixes to resolve the root cause

• Deploy patches through normal CI/CD pipeline (emergency fast-track for critical issues)

• Verify the fix in production

• Restore any affected services to normal operation

5. Recovery & Verification

• Confirm all systems are operating normally

• Monitor for any recurrence over 24-48 hours

• Restore any data from backups if necessary

Communication

• Severity 1 incidents: Affected customers notified within 24 hours of confirmed impact

• Severity 2 incidents: Affected customers notified within 48 hours if their data was impacted

• All notifications include: what happened, what data was affected, what we are doing about it, and recommended actions for the customer

• If legally required (e.g., under GDPR breach notification), relevant authorities are notified within 72 hours

Post-Incident Review

After every Severity 1 or 2 incident, we conduct a blameless post-mortem within 5 business days:

• Document the full timeline from detection to resolution

• Identify root cause and contributing factors

• Define concrete action items to prevent recurrence

• Assign owners and deadlines for each action item

• Track completion of action items