This procedure defines how security incidents and personal data breaches are detected, contained, investigated, and reported — including GDPR Art. 33/34 breach notification obligations.

2. Severity Classification

| Severity | Definition | Examples | Response SLA | |----------|-----------|---------|-------------| | P1 — Critical | Data breach with confirmed personal data exposure, or full service outage | Database dump leaked; ransomware; production down >1h | Immediate (24/7) | | P2 — High | Suspected breach, significant service degradation, or security control failure | Suspicious auth activity; PII decryption key possibly compromised; >50% error rate | Within 2 hours | | P3 — Medium | Partial service disruption or security anomaly requiring investigation | Unusual traffic spike; single user lockout; backup failure | Within 8 hours (business hours) | | P4 — Low | Non-impacting security finding or informational alert | Failed login attempts within normal range; expired certificate warning | Within 5 business days |

3. Escalation Matrix

Detect (monitoring / alert / report)
    │
    ▼
Developer on-call ──────────────────────────────────── P3/P4
    │
    ├─ Personal data at risk? ──YES──► Notify DPO immediately ─► P1/P2
    │
    ▼
Technical Lead ────────────────────────────────────── P1/P2
    │
    ├─ Breach confirmed? ──YES──► DPO + CTO
    │                                   │
    │                          ◄──72h──► AP notification (Art. 33)
    │
    └─ Data subjects at HIGH risk? ──YES──► Direct notification (Art. 34)

| Role | Contact | Escalate when | |------|---------|---------------| | Developer on-call | [TBD] | Any alert | | Technical Lead | [TBD] | P1/P2 | | DPO | [TBD] | Any personal data at risk | | CTO | [TBD] | P1, or breach confirmed | | Autoriteit Persoonsgegevens (AP) | www.autoriteitpersoonsgegevens.nl / 088-1805250 | Breach within 72h |

4. Incident Response Steps

Phase 1 — Detect & Triage (0–30 min)

[ ] Confirm the incident is real (not a false positive)
[ ] Assess severity using §2
[ ] Open an incident channel (Slack / Teams / Signal) with relevant parties
[ ] Begin incident log (timestamp every action)
[ ] Determine if personal data is involved → if yes, notify DPO immediately

Detection sources:

GitHub Actions / Helm alerts (deployment failures)
Application logs (com.claimio log level INFO/ERROR)
k8s pod health (kubectl get pods -n claimio)
Backup verify workflow failures
Tenant/user reports

Phase 2 — Contain (30 min – 2 h)

[ ] Isolate affected system if needed (scale down deployment, revoke tokens)

[ ] Revoke compromised credentials immediately:

# Rotate JWT secret (invalidates all sessions)
# Trigger rotate-secrets workflow in GitHub Actions

[ ] Block suspicious IP at TransIP firewall or nginx ingress if applicable

[ ] Preserve evidence: export logs, create DB snapshot before any cleanup

kubectl logs -n claimio deploy/claimio-backend --since=1h > /tmp/incident-logs.txt

[ ] For DB breach: change claimio_app and claimio database passwords immediately

Phase 3 — Eradicate (2–8 h)

[ ] Identify root cause (code vulnerability, misconfiguration, compromised credential)
[ ] Apply fix (hotfix branch from main, merge into both main and develop)
[ ] Remove attacker persistence if any (check for unknown k8s resources, unusual processes)
[ ] Verify PII encryption keys are not exposed (check git history, env vars)
[ ] Run OWASP ZAP scan after fix: make test-security

Phase 4 — Recover

[ ] Redeploy patched version via CI/CD
[ ] Verify health endpoints: curl https://api.claimio.nl/actuator/health
[ ] Monitor error rates for 24h post-recovery
[ ] Restore data from backup if corruption occurred (see BCDR §5.2)
[ ] Re-enable any disabled features

Phase 5 — Post-Incident Review (within 5 business days)

[ ] Write incident report (timeline, root cause, impact, remediation)
[ ] Update risk register in /ocs/claimio/risk-assessment.md
[ ] Create GitHub issues for any required follow-up security improvements
[ ] Share learnings with team
[ ] Update this procedure if gaps were identified

5. GDPR Breach Notification

Art. 33 — Notification to Supervisory Authority (AP)

Trigger: Any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Deadline: Without undue delay — within 72 hours of becoming aware.

Report to: Autoriteit Persoonsgegevens — https://datalekken.autoriteitpersoonsgegevens.nl

Required information (Art. 33(3)):

Nature of the breach (categories and approximate number of data subjects and records)
Contact details of DPO
Likely consequences of the breach
Measures taken or proposed to address the breach

If 72h cannot be met: Submit what is known and state reasons for delay; supplement later.

Art. 34 — Communication to Data Subjects

Trigger: Breach likely to result in high risk to rights and freedoms of natural persons.

High risk indicators for claimio:

Exposure of unencrypted IBAN numbers
Exposure of identity information (name + address + license plate combination)
Compromise of photo signing keys (enabling fraudulent claim submission)

Communication channel: Email to affected claimants (email stored encrypted; decryption required).

Template — Data Subject Notification:

Subject: Melding datalek — uw gegevens bij [Tenant Naam]

Geachte [naam],

Wij hebben vastgesteld dat er sprake is geweest van een datalek waarbij mogelijk uw persoonsgegevens zijn betrokken.

Wat is er gebeurd? [Beschrijving van het incident in begrijpelijke taal]

Welke gegevens zijn betrokken? [Lijst van betrokken gegevenstypen]

Wat hebben wij gedaan? [Genomen maatregelen]

Wat kunt u doen? [Aanbevolen acties voor betrokkene, bijv. wachtwoord wijzigen]

Voor vragen kunt u contact opnemen met onze Functionaris Gegevensbescherming via [DPO contact].

Met vriendelijke groet, [Tenant Naam] / GloryLabs

6. Incident Log Template

INCIDENT LOG
============
ID:           INC-YYYY-NNN
Date opened:
Severity:     P1 / P2 / P3 / P4
Reporter:
Status:       Open / Contained / Resolved / Closed

TIMELINE
--------
[HH:MM] - [Action taken / observation]
[HH:MM] - ...

ROOT CAUSE
----------

IMPACT
------
- Systems affected:
- Data subjects affected: (number and categories)
- Personal data types:
- Duration of exposure:

ACTIONS TAKEN
-------------

NOTIFICATION STATUS
-------------------
- DPO notified: Yes/No — [timestamp]
- AP notified:  Yes/No — [timestamp] — reference: [AP reference number]
- Data subjects notified: Yes/No — [timestamp] — method:

FOLLOW-UP
---------
- GitHub issues created:
- Lessons learned:

7. Document Maintenance

| Version | Date | Author | Changes | |---------|------|--------|---------| | 1.0 | 2026-03-30 | GloryLabs | Initial version |

Reacties

Nog geen reacties

Athena — claimio/compliance/processes/incident-handling.md

title: Incident Handling and Breach Notification Procedure project: claimio version: 1.0 date: 2026-03-30 owner: GloryLabs classification: Internal

Incident Handling and Breach Notification Procedure — claimio

1. Purpose