# Incident response and escalation policy

**Policy version:** 1.0.0.

**Status:** prepared policy; not operationally accepted. Incident commander,
security contact, privacy contact, deputies, tested channels, and drill evidence
remain external blockers.

## Severity

| Severity | Example impact | Initial target after valid intake* | Escalation |
|---|---|---|---|
| SEV-1 critical | Active loss/custody risk, key compromise, broad unauthorized access, critical write-path integrity failure | 15 minutes | Incident commander, security, privacy if data involved, change authority, leadership/counsel/insurer as applicable |
| SEV-2 high | Material degradation or credible exploit without observed loss | 1 hour | Incident commander and relevant technical/support owners |
| SEV-3 medium | Limited impact with workaround; no custody or sensitive-data indication | 1 business day | Support owner and component owner |
| SEV-4 low | Question, cosmetic defect, documentation issue | 2 business days | Normal support queue |

\*Targets apply only after a tier is selected, coverage begins, and named
channels are tested. They are targets, not a guarantee of resolution.

## Lifecycle

1. **Detect/intake:** timestamp, candidate ID, reporter, scope, and minimum
   necessary facts. Do not demand surveillance or unrelated personal data.
2. **Triage:** assign severity, incident commander, affected scope, evidence
   custodian, and next update time.
3. **Contain:** prefer reversible controls; preserve V2 withdrawal/route
   continuity and bounded exits. No operator may seize or repurpose principal.
4. **Remediate/recover:** peer review, test, approve, candidate-bind, deploy
   only through separately authorized change management, then verify state.
5. **Communicate:** provide factual impact, mitigations, and next update; no
   unverified blame, audit claim, or legal conclusion.
6. **Close/learn:** affected-party confirmation where appropriate, evidence
   retention, post-incident review target within 10 business days for SEV-1/2,
   and tracked corrective actions.

Notification to regulators, law enforcement, insurers, or affected persons is
determined by authorized humans with counsel; this package makes no
notification-law conclusion. Runbooks and routes must be exercised before a
partner-ready claim and at least annually or after material change.
