What does the incident response plan look like?
amaise has a documented incident response plan with defined severity levels and a clear procedure:
Severity levels:
S1 (Critical): Data leak, compromised credentials, ransomware — immediate escalation, all available resources
S2 (High): Suspicious access, exploited vulnerability — response within the same day
S3 (Low): Blocked attack, policy violation — response within 24 hours
Procedure:
Detection (employee report, monitoring alert, external notification)
Assessment of severity and scope
Containment — isolate affected systems, revoke compromised credentials
Investigation — secure evidence, determine cause
Remediation — close vulnerability, restore services
Communication — notify affected parties and regulatory authorities
Post-mortem — document lessons learned, update controls
Customer notification in case of incidents:
amaise notifies affected customers within 24 hours after identifying a security incident involving their data. For S1 and S2 incidents, amaise offers joint coordination (bridge calls) upon request, so customers can meet their own regulatory reporting obligations on time.