Incidents rapidly detected, contained and resolved
Onesurance monitors its environment 24/7 and maintains a structured incident response process to rapidly detect, contain and resolve security incidents. Our Incident Response Team operates under the leadership of the Data Protection Officer and follows a structured 6-step process.
- 24/7 monitoring: continuous automated monitoring, around the clock; response times apply during office hours.
- <60 minutes P1 response time: critical incidents addressed within 60 minutes during office hours.
- Data breaches reported within 24 hours: clients are informed without undue delay and in any event within 24 hours of discovery or reasonable suspicion of a data breach.
- 6-step process: from detection to closure, fully documented.
- IRT led by DPO: Incident Response Team directed by the Data Protection Officer.
Every incident follows six fixed steps
Our incident response process consists of six clearly defined phases. Every security incident progresses through these phases to ensure rapid, effective and documented resolution. The Incident Response Team (IRT) is activated for every confirmed incident and operates under the leadership of the Data Protection Officer.
Detection and reporting
Incidents are detected through multiple channels and escalated immediately.
- 24/7 automated monitoring: Azure Security Center, SIEM and anomaly detection run continuously.
- Reporting channels: employees, clients and third parties can report incidents by email (support@onesurance.ai for technical reports, dpo@onesurance.ai for security and privacy) or via the internal ticketing system.
- For P1, report immediately: when a critical incident (P1) is suspected, report it immediately by email to the DPO via dpo@onesurance.ai.
Assessment and classification
Every reported incident is assessed for severity and impact by the designated coordinator.
- Incident coordinator: the DPO or designated deputy assumes coordination.
- Severity classification: incidents are classified as P1 (Critical), P2 (High), P3 (Medium) or P4 (Low).
- IRT activation: for P1 and P2 incidents, the full Incident Response Team is activated.
Containment
Immediate measures to limit damage and prevent further propagation.
- Firewall rules: block suspicious traffic and attack vectors through firewall adjustments.
- Isolation: affected systems are isolated from the network to prevent lateral movement.
- Preserve logs: all relevant logs and evidence are secured for forensic investigation.
Investigation
In-depth investigation into the cause, scope and impact of the incident.
- Root cause analysis: determine the underlying cause of the incident.
- Attack methodology: identification of the attack technique and vector used.
- Timeline: reconstruction of the full incident timeline, from initial compromise to detection.
Remediation and recovery
Systems are restored to a secure, operational state.
- Patching: vulnerabilities are patched and security updates applied.
- Malware removal: removal of malicious software and backdoors.
- Clean backups: restoration from verified, clean backups.
- Reset credentials: all potentially compromised passwords and keys are reset.
- 48-hour monitoring: after recovery, systems are intensively monitored for at least 48 hours for recurring activity.
Closure and documentation
The incident is formally closed and all lessons are documented.
- Incident report: complete report with timeline, impact, root cause and measures taken.
- Lessons learned: evaluation session with the IRT to identify areas for improvement.
- Procedure updates: updates to procedures, policies and technical controls based on findings.
Severity determines how fast we respond
Every incident is classified based on severity and impact. The classification determines the response time, escalation level and available resources.
| Level | Response time | Resolution time | Examples | Escalation |
|---|---|---|---|---|
| Critical P1 | <60 minutes | <48 hours | Active data breach, ransomware attack, full system compromise | Immediately by email (dpo@onesurance.ai): DPO + executive team |
| High P2 | <4 hours | <72 hours | Potential data breach, unauthorised access to production systems | Email (dpo@onesurance.ai): DPO |
| Medium P3 | <1 business day | <20 business days | Suspicious activity, phishing attempt with click, production vulnerability | Email: DPO |
Report a P1 incident immediately by email
In the event of a security incident, please contact the individuals listed below. Report a P1 incident immediately via dpo@onesurance.ai; technical disruptions via support@onesurance.ai.
A plan we rehearse regularly
The incident response plan is tested regularly to ensure effectiveness and keep the team well-prepared.
Annual tabletop exercises
At least once per year, the IRT conducts a tabletop exercise. A realistic incident scenario is walked through without actual system impact, to validate decision-making and communication processes.
Scenario testing
Specific scenarios such as ransomware, data breach and insider threat are simulated. After each exercise, findings are documented and the incident response plan is updated accordingly.
Questions about incident response?
Our Data Protection Officer is happy to assist with questions about our incident response process, security notifications or escalation procedures.