Incident Response Plan

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: Robert — Security Lead

Next review: 11 July 2027

---

1. Purpose

Define how Touch2Sign detects, responds to, contains, and recovers from information security incidents, including personal data breaches under GDPR Articles 33–34.

2. Scope

All incidents affecting:

• Touch2Sign production systems (AWS eu-west-1)
• Customer documents, audit data, or personal data
• Authentication systems (Cognito)
• Sub-processor breaches affecting Touch2Sign data

3. Severity levels

Level	Description	Examples	Response target
P1 Critical	Active breach, data exfiltration, full outage	DB exposed publicly, ransomware, mass document leak	Immediate — all hands
P2 High	Limited data exposure, partial outage, admin compromise	Single tenant data leak, signing API down	1 hour
P3 Medium	Attempted attack, vulnerability with exploit path	Failed brute force, critical CVE in production dep	4 hours
P4 Low	Minor issue, no data impact	Phishing email reported, scan noise	24 hours

4. Roles

Role	Person	Responsibilities
Incident Commander (IC)	Robert	Coordinates response; comms; escalation
Technical Lead	Robert	Containment; forensics; remediation
DPO / Privacy Lead	Robert	Breach assessment; ICO/DPC notification; DSAR impact
Comms	Robert	Customer notification; status page
Legal	External counsel	Regulatory advice; law enforcement

On-call rotation: Robert (sole operator) — email security@touch2sign.com; escalate to external counsel for P1 personal data breaches.

5. Incident response phases

Phase 1 — Detection & triage (0–30 min)

Sources: CloudWatch alarms, customer report, staff report, sub-processor notification, pentest finding.

1. Log incident in Incident Register (ticket + spreadsheet)
2. Assign severity (P1–P4)
3. Notify IC and Technical Lead
4. Preserve evidence — do not delete logs or DB rows

Phase 2 — Containment (30 min – 4 hr)

Scenario	Actions
Compromised admin account	Disable Cognito user; rotate sessions; review audit_log
Leaked API key / secret	Rotate in Secrets Manager; revoke old key; review access logs
Suspected document access	Identify affected document IDs; block signing tokens; notify customer
Sub-processor breach	Contact vendor; assess Touch2Sign data affected
DDoS / outage	AWS support; scale App Runner; CloudFront rules

Phase 3 — Assessment (parallel with containment)

GDPR breach assessment worksheet:

• [ ] Did personal data breach occur? (Art 4(12))
• [ ] What categories of data? (names, emails, IDV, document content)
• [ ] How many data subjects affected?
• [ ] Likely consequences?
• [ ] Risk to rights and freedoms — high or low?
• [ ] Notify supervisory authority within 72 hours? (Art 33)
• [ ] Notify data subjects required? (Art 34)
• [ ] Notify customers (processors) without undue delay? (DPA §4)

Phase 4 — Eradication & recovery

1. Root cause identified and fixed
2. Patches deployed via change management
3. Services restored; monitoring enhanced
4. Verify integrity — sample audit trails, document hashes

Phase 5 — Post-incident (within 5 business days)

1. Post-incident review meeting — blameless
2. Document timeline, root cause, lessons learned
3. Corrective actions assigned with owners and dates
4. Update risk register
5. Update policies/controls if needed
6. Retain incident record 3 years minimum

6. Notification templates

6.1 Internal (Slack / email)

```

INCIDENT [P1/P2/P3/P4]: [Short title]

Detected: [time UTC]

Impact: [description]

IC: [name]

Status: Investigating / Contained / Resolved

Next update: [time]

```

6.2 Customer (processor breach)

```

Subject: Touch2Sign security incident notification

We are writing to inform you of a security incident affecting Touch2Sign

services on [date].

What happened: [brief factual description]

Data affected: [categories — avoid overstating]

Actions taken: [containment steps]

Your actions: [if any — rotate tokens, notify signers, etc.]

Contact: security@touch2sign.com

We will provide updates within [24/48] hours.

```

6.3 Supervisory authority (ICO / DPC — within 72h)

Use official breach notification forms:

• ICO: https://ico.org.uk/for-organisations/report-a-breach/
• DPC Ireland: https://www.dataprotection.ie/

Include: nature of breach, DPO contact, likely consequences, measures taken.

7. Touch2Sign-specific playbooks

7.1 Signing token compromise

1. Identify token(s) in recipients table
2. Invalidate — mark document void or rotate token
3. Review audit_log for access from token
4. Notify document sender

7.2 IDV provider incident (OneID / eID Easy)

1. Contact provider security team
2. Determine if Touch2Sign signer PII exposed
3. If yes — customer notification + DPIA review
4. Document in sub-processor incident log

7.3 RDS / S3 misconfiguration

1. Block public access immediately (S3 bucket policy, RDS security group)
2. AWS CloudTrail review for unauthorized GetObject / SELECT
3. List affected objects / rows
4. P1 if customer documents exposed

8. Testing

• Tabletop exercise — annually minimum; after major architecture change
• First tabletop target: Month 3 of compliance programme
• Scenario suggestions: leaked admin credential; Anthropic data handling query; witness evidence challenge

9. Incident register fields

Field	Description
ID	INC-YYYY-NNN
Date detected	UTC timestamp
Severity	P1–P4
Description
Data breach?	Y/N
Subjects affected	Count / range
ICO/DPC notified?	Y/N/NA
Customers notified?	Y/N
Status	Open / Closed
Closed date
Lessons learned

10. Contact list

Contact	Email / phone
Security Lead	security@touch2sign.com
DPO	privacy@touch2sign.com
AWS Support	[Enterprise support case]
Legal counsel	[Firm contact]
ICO	0303 123 1113
DPC Ireland	+353 578 684 800

---

Approval

Name	Role	Signature	Date
Robert	CEO / Security Lead	Electronic	11 July 2026