Incident response and continuity

Investigation, customer coordination, breach assessment, and recovery procedures.

Response process

AMLOK’s incident-response process covers suspected unauthorized access, credential exposure, integrity problems, cross-tenant access, material disruption, and unintended workflow actions.

1. Triage and contain

   Assign an owner, record discovery and event times, establish known facts, and restrict exposure. Preserve relevant evidence during containment.
2. Assess impact

   Identify affected systems, customers, data, and activities. Record uncertainty and reassess severity as the investigation progresses.
3. Coordinate notifications

   Determine contractual and legal obligations, responsible parties, channels, and required content. Do not delay a required notice until a final root-cause report.
4. Recover and verify

   Restore through an approved process, verify integrity and access boundaries, and reconcile unfinished work before replaying actions.
5. Review and improve

   Document cause, impact, response, and corrective actions. Assign owners and verify material fixes.

Customer communication

The agreement should define contacts, notification triggers, timing, updates, and assistance with affected-person or regulator communications. A service notification and statutory breach report may have different recipients, thresholds, and deadlines.

Report security concerns and vulnerabilities to [e-mail], using the published disclosure policy. Use your agreed incident channel for customer-specific coordination. Do not include credentials or unnecessary borrower information in an initial report. Coordinate sensitive evidence through an agreed secure channel.

Canadian breach requirements

Under PIPEDA, qualifying breaches creating a real risk of significant harm must be reported to the OPC and notified to affected individuals as soon as feasible. Records of all breaches of security safeguards must be kept for at least 24 months. The responsible organization must assess the threshold and obligations. See the OPC breach guidance.

Assess provincial requirements and customer-regulator obligations separately. See Canadian requirements and Quebec privacy.

Customer-specific incident communication follows the agreed channels and notification obligations.

Continuity and recovery

AMLOK’s continuity procedures address critical services and dependencies, backup protection, and recovery from provider or regional outages. Recovery-time and recovery-point commitments are deployment-specific and belong in the agreement.

Review restoration results, integrity checks, measured recovery time, potential data loss, and follow-up actions. A stored backup alone does not demonstrate successful restoration.

Distinguish unavailable or stale evidence from a valid zero balance or clean risk result. Define whether processing pauses, continues with identified limitations, or moves to human review.