Data breach and incident response procedure
How a security incident would be handled, written from the current operational reality.
Draft — not in force. Draft 0.1 · Not in force — no effective date has been set · Awaiting review by a qualified lawyer (UK data-protection and commercial law).
Roles
- The accounting firm is the controller for its client and staff data and decides whether to notify the ICO (within 72 hours of becoming aware, where a breach is likely to result in a risk) and affected individuals (without undue delay, where the risk is high).
- INVICTT AI, as processor, must tell the affected firm's administrators without undue delay after becoming aware of a breach of that firm's data, with the facts known at the time.
Steps
- Contain: stop the affected process, revoke sessions or keys (sessions can be revoked per user; the system keys can be rotated with the documented tools).
- Assess: use the tamper-evident audit trail (hash-chained per firm) and security event log to establish what was accessed and when.
- Notify: firms first, then — if INVICTT AI is itself controller for the data (account and billing data) — the ICO and individuals as required.
- Record: every incident is recorded with its risk assessment, whether or not it is notified.
- Review: root cause, fix, regression test, and an update to this procedure.
Limits today
There is no 24/7 monitoring or on-call rota, no dedicated security mailbox and no external incident-response retainer. Reports go to invictt.com/contact.
Decisions required before this can take effect
Matters for professional legal approval or for INVICTT AI to determine. They are deliberately not answered here.
- Named incident lead and deputy; contact route for firms; a dedicated security mailbox.
- Notification template and timing commitment in the DPA.
- Whether INVICTT AI must pay the ICO data protection fee (depends on its own controller processing).