# Incident Response Plan

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** Robert — Security Lead  
**Next review:** 11 July 2027

---

## 1. Purpose

Define how Touch2Sign detects, responds to, contains, and recovers from information security incidents, including personal data breaches under GDPR Articles 33–34.

## 2. Scope

All incidents affecting:

- Touch2Sign production systems (AWS eu-west-1)  
- Customer documents, audit data, or personal data  
- Authentication systems (Cognito)  
- Sub-processor breaches affecting Touch2Sign data  

## 3. Severity levels

| Level | Description | Examples | Response target |
|-------|-------------|----------|-----------------|
| **P1 Critical** | Active breach, data exfiltration, full outage | DB exposed publicly, ransomware, mass document leak | Immediate — all hands |
| **P2 High** | Limited data exposure, partial outage, admin compromise | Single tenant data leak, signing API down | 1 hour |
| **P3 Medium** | Attempted attack, vulnerability with exploit path | Failed brute force, critical CVE in production dep | 4 hours |
| **P4 Low** | Minor issue, no data impact | Phishing email reported, scan noise | 24 hours |

## 4. Roles

| Role | Person | Responsibilities |
|------|--------|------------------|
| **Incident Commander (IC)** | Robert | Coordinates response; comms; escalation |
| **Technical Lead** | Robert | Containment; forensics; remediation |
| **DPO / Privacy Lead** | Robert | Breach assessment; ICO/DPC notification; DSAR impact |
| **Comms** | Robert | Customer notification; status page |
| **Legal** | External counsel | Regulatory advice; law enforcement |

**On-call rotation:** Robert (sole operator) — email security@touch2sign.com; escalate to external counsel for P1 personal data breaches.

## 5. Incident response phases

### Phase 1 — Detection & triage (0–30 min)

**Sources:** CloudWatch alarms, customer report, staff report, sub-processor notification, pentest finding.

1. Log incident in **Incident Register** (ticket + spreadsheet)  
2. Assign severity (P1–P4)  
3. Notify IC and Technical Lead  
4. Preserve evidence — do not delete logs or DB rows  

### Phase 2 — Containment (30 min – 4 hr)

| Scenario | Actions |
|----------|---------|
| Compromised admin account | Disable Cognito user; rotate sessions; review audit_log |
| Leaked API key / secret | Rotate in Secrets Manager; revoke old key; review access logs |
| Suspected document access | Identify affected document IDs; block signing tokens; notify customer |
| Sub-processor breach | Contact vendor; assess Touch2Sign data affected |
| DDoS / outage | AWS support; scale App Runner; CloudFront rules |

### Phase 3 — Assessment (parallel with containment)

**GDPR breach assessment worksheet:**

- [ ] Did personal data breach occur? (Art 4(12))  
- [ ] What categories of data? (names, emails, IDV, document content)  
- [ ] How many data subjects affected?  
- [ ] Likely consequences?  
- [ ] Risk to rights and freedoms — high or low?  
- [ ] Notify supervisory authority within **72 hours**? (Art 33)  
- [ ] Notify data subjects required? (Art 34)  
- [ ] Notify customers (processors) without undue delay? (DPA §4)  

### Phase 4 — Eradication & recovery

1. Root cause identified and fixed  
2. Patches deployed via change management  
3. Services restored; monitoring enhanced  
4. Verify integrity — sample audit trails, document hashes  

### Phase 5 — Post-incident (within 5 business days)

1. **Post-incident review** meeting — blameless  
2. Document timeline, root cause, lessons learned  
3. Corrective actions assigned with owners and dates  
4. Update risk register  
5. Update policies/controls if needed  
6. Retain incident record **3 years minimum**  

## 6. Notification templates

### 6.1 Internal (Slack / email)

```
INCIDENT [P1/P2/P3/P4]: [Short title]
Detected: [time UTC]
Impact: [description]
IC: [name]
Status: Investigating / Contained / Resolved
Next update: [time]
```

### 6.2 Customer (processor breach)

```
Subject: Touch2Sign security incident notification

We are writing to inform you of a security incident affecting Touch2Sign 
services on [date]. 

What happened: [brief factual description]
Data affected: [categories — avoid overstating]
Actions taken: [containment steps]
Your actions: [if any — rotate tokens, notify signers, etc.]
Contact: security@touch2sign.com

We will provide updates within [24/48] hours.
```

### 6.3 Supervisory authority (ICO / DPC — within 72h)

Use official breach notification forms:

- ICO: https://ico.org.uk/for-organisations/report-a-breach/  
- DPC Ireland: https://www.dataprotection.ie/  

Include: nature of breach, DPO contact, likely consequences, measures taken.

## 7. Touch2Sign-specific playbooks

### 7.1 Signing token compromise

1. Identify token(s) in `recipients` table  
2. Invalidate — mark document void or rotate token  
3. Review `audit_log` for access from token  
4. Notify document sender  

### 7.2 IDV provider incident (OneID / eID Easy)

1. Contact provider security team  
2. Determine if Touch2Sign signer PII exposed  
3. If yes — customer notification + DPIA review  
4. Document in sub-processor incident log  

### 7.3 RDS / S3 misconfiguration

1. Block public access immediately (S3 bucket policy, RDS security group)  
2. AWS CloudTrail review for unauthorized GetObject / SELECT  
3. List affected objects / rows  
4. P1 if customer documents exposed  

## 8. Testing

- **Tabletop exercise** — annually minimum; after major architecture change  
- First tabletop target: **Month 3** of compliance programme  
- Scenario suggestions: leaked admin credential; Anthropic data handling query; witness evidence challenge  

## 9. Incident register fields

| Field | Description |
|-------|-------------|
| ID | INC-YYYY-NNN |
| Date detected | UTC timestamp |
| Severity | P1–P4 |
| Description | |
| Data breach? | Y/N |
| Subjects affected | Count / range |
| ICO/DPC notified? | Y/N/NA |
| Customers notified? | Y/N |
| Status | Open / Closed |
| Closed date | |
| Lessons learned | |

## 10. Contact list

| Contact | Email / phone |
|---------|---------------|
| Security Lead | security@touch2sign.com |
| DPO | privacy@touch2sign.com |
| AWS Support | [Enterprise support case] |
| Legal counsel | [Firm contact] |
| ICO | 0303 123 1113 |
| DPC Ireland | +353 578 684 800 |

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO / Security Lead | Electronic | 11 July 2026 |