EcoService OSCompliance Center
Compliance Center
Policies

Incident Response

Incident response plan for EcoService OS — severity levels, on-call escalation, containment, notification, and post-incident review.

Incident Response Plan

Version: 1.0 · Effective: July 14, 2026 · Owner: Security Lead On-call: engmartin@ecopowerhub.ai · 24/7 monitored

1. Definitions

  • Event — anything unusual (e.g. spike in 500s, failed logins). Logged, not necessarily actioned.
  • Incident — confirmed impact to CIA of Company or customer data.
  • Breach — an incident involving unauthorized access to personal data. Regulator-notifiable.

2. Severity levels

SevDefinitionResponse timeComms
SEV-1Prod down, data loss, active exploitImmediate, 24/7Status page + email to affected customers within 4 h
SEV-2Degraded service, single-tenant data exposure< 2 hStatus page
SEV-3Minor bug, no data at riskNext business dayRelease notes

3. Lifecycle (NIST 800-61)

  1. Prepare — this plan, on-call rota, runbooks, Sentry + security_events dashboard.
  2. Detect — Sentry alerts, Supabase logs, /security dashboard, customer report at engmartin@ecopowerhub.ai.
  3. Analyze — Incident commander opens a war-room note (private), assigns severity, scope, and impacted data classes.
  4. Contain — rotate compromised keys, revoke sessions, block IPs via rate-limit table, disable feature flag if applicable.
  5. Eradicate — patch root cause, deploy fix, add regression test.
  6. Recover — restore service, validate via smoke tests (/admin/smoke-test), monitor 24 h.
  7. Post-mortem — blameless RCA within 5 business days, action items tracked in risk register.

4. Roles during an incident

  • Incident Commander (IC): decides, delegates, owns the timeline. Default: Security Lead.
  • Communications Lead: customer + regulator messaging.
  • Scribe: timestamped log of every action.
  • Engineer(s): hands-on remediation.

5. External notifications

TriggerRecipientDeadline
Personal-data breach (GDPR)Lead supervisory authority72 hours
Personal-data breach (high risk)Affected data subjectsWithout undue delay
Payment card exposureStripe + card brands24 hours
US state breach lawsState AGs per applicable lawPer statute (typically 30–60 d)

6. Evidence & forensics

  • Preserve logs, DB snapshots, and audit_logs for at least 1 year post-incident.
  • Do not alter compromised systems until snapshots are taken.

7. Testing

  • Tabletop exercise every 6 months.
  • Restore-from-backup drill every 6 months.
  • Results and gaps captured in the risk register.

8. Contact tree