Incident Response Plan

Last Updated: 2026-02-12 Standard: ISO 27001:2022 -- A.16 Information Security Incident Management Review Cycle: Annually

1. Purpose#

This plan establishes a structured and repeatable approach to identifying, containing, eradicating, and recovering from information security incidents affecting cloak.business systems, data, or services. It ensures that incidents are handled efficiently, impacts are minimized, and lessons are incorporated into future prevention.

2. Scope#

This plan covers all security incidents affecting:

• cloak.business platform services and infrastructure
• Customer data processed or stored by the platform
• User accounts and authentication systems
• Third-party integrations and sub-processors
• Internal systems and personnel

3. Incident Classification#

Severity Levels#

Incident Categories#

• Unauthorized access -- Successful or attempted access by unauthorized parties
• Data breach -- Confirmed or suspected exposure of personal or sensitive data
• Service disruption -- Denial of service, outage, or degradation affecting users
• Malware -- Detection of malicious software on any system
• Vulnerability exploitation -- Active exploitation of a known or zero-day vulnerability
• Insider threat -- Unauthorized actions by personnel with legitimate access
• Physical security -- Unauthorized physical access to data center or equipment

4. Response Phases#

Phase 1: Identification#

Objective: Detect and confirm the security incident.

• Monitoring alerts -- Automated monitoring systems flag anomalous activity
• User reports -- Users or personnel report suspicious behavior through established channels
• Log analysis -- Review of access logs, error logs, and audit trails
• Initial assessment -- Determine whether the event constitutes a security incident
• Incident logging -- Create an incident record with initial details, time of detection, and preliminary classification

Phase 2: Containment#

Objective: Limit the scope and impact of the incident.

• Short-term containment -- Immediately isolate affected systems or accounts to prevent further damage
• Evidence preservation -- Secure logs, system snapshots, and other evidence before remediation
• Access restriction -- Revoke or restrict access for compromised accounts or credentials
• Communication -- Notify the incident response team and relevant stakeholders
• Impact assessment -- Determine what data, systems, and users are affected

Phase 3: Eradication#

Objective: Remove the root cause of the incident.

• Root cause analysis -- Identify the vulnerability, misconfiguration, or attack vector that enabled the incident
• Remediation -- Apply patches, update configurations, rotate credentials, or take other corrective actions
• Verification -- Confirm that the root cause has been eliminated and the attack vector is closed
• Sweep -- Check for additional indicators of compromise across related systems

Phase 4: Recovery#

Objective: Restore normal operations safely.

• System restoration -- Bring affected systems back online in a controlled manner
• Data integrity verification -- Confirm that data has not been altered or corrupted
• Enhanced monitoring -- Increase monitoring intensity for a defined period to detect recurrence
• Service validation -- Verify that all services are operating correctly before declaring recovery complete
• User communication -- Inform affected users that the incident has been resolved and services are restored

Phase 5: Lessons Learned#

Objective: Improve future prevention and response.

• Post-incident review -- Conduct a review meeting within 5 business days of resolution
• Incident report -- Document the full timeline, root cause, impact, and response actions
• Control improvements -- Identify and implement security control enhancements to prevent recurrence
• Process updates -- Revise response procedures based on what worked well and what can be improved
• Policy review -- Update security policies if the incident revealed gaps

5. GDPR Breach Notification#

cloak.business maintains compliance with GDPR breach notification requirements:

Supervisory Authority Notification (Article 33)#

• Personal data breaches are reported to the relevant supervisory authority within 72 hours of becoming aware of the breach
• The notification includes:
  • Nature of the breach and categories of data affected
  • Approximate number of data subjects and records involved
  • Likely consequences of the breach
  • Measures taken or proposed to address the breach

Data Subject Notification (Article 34)#

• Where a breach is likely to result in a high risk to the rights and freedoms of individuals, affected data subjects are notified without undue delay
• The notification includes:
  • Description of the breach in clear, plain language
  • Contact information for further inquiries
  • Likely consequences of the breach
  • Measures taken to address the breach and mitigate its effects

Customer Notification#

• Customers acting as data controllers are notified promptly of any breach affecting their data, enabling them to meet their own notification obligations under GDPR

6. Communication#

Internal Communication#

External Communication#

7. Roles and Responsibilities#

8. Testing and Maintenance#

• Tabletop exercises -- Conducted annually to validate the response plan
• Plan review -- Reviewed annually and after every significant incident
• Contact list updates -- Verified quarterly to ensure all response team contacts are current
• Training -- Incident response training provided to all relevant personnel

Revision History#

Document maintained by cloak.business Contact: support@cloak.business