KONTYRA Legal

Incident Response Policy

This Incident Response Policy defines how KONTYRA prepares for, detects, assesses, contains, remediates, recovers from, and learns from security and operational incidents.

1. Purpose

The purpose of this policy is to reduce the impact of incidents, preserve evidence, restore normal operations, protect affected users, meet legal and contractual obligations, and improve KONTYRA security practices over time.

2. Scope

This policy applies to incidents involving:

  • KONTYRA production services, websites, APIs, repositories, cloud environments, and internal tools.
  • Unauthorized access to systems, accounts, credentials, source code, secrets, customer data, or business information.
  • Service disruptions, abuse campaigns, data exposure, malware, suspicious privileged activity, or confirmed policy violations.
  • Vendors, contractors, or third-party services that materially affect KONTYRA systems or data.

3. Incident Severity

KONTYRA classifies incidents based on impact and urgency:

  • Critical: confirmed compromise of production systems, sensitive data exposure, active exploitation, or major service outage.
  • High: likely compromise, limited data exposure, significant service degradation, or exploitable vulnerability with elevated risk.
  • Medium: suspicious activity, contained vulnerability, localized service impact, or policy violation with limited exposure.
  • Low: informational finding, attempted activity without confirmed impact, or issue requiring tracking but not emergency response.

4. Roles and Responsibilities

  • Incident Lead: coordinates response, assigns tasks, tracks decisions, and declares status changes.
  • Technical Responders: investigate root cause, contain affected systems, preserve evidence, and implement remediation.
  • Communications Owner: prepares internal updates, customer notices, status messaging, and external communications when needed.
  • Legal or Compliance Reviewer: evaluates notification duties, contractual requirements, law enforcement interaction, and recordkeeping.

5. Response Lifecycle

KONTYRA follows a lifecycle aligned with recognized incident response practices:

  • Prepare: maintain contacts, access, logging, backups, runbooks, and escalation paths.
  • Detect and analyze: validate alerts, determine scope, classify severity, identify affected assets, and preserve relevant evidence.
  • Contain: limit harm by isolating systems, disabling accounts, rotating secrets, blocking traffic, or applying temporary controls.
  • Eradicate and recover: remove malicious artifacts, patch vulnerabilities, rebuild systems when needed, restore service, and monitor for recurrence.
  • Post-incident review: document timeline, root cause, impact, decisions, customer effects, and corrective actions.

6. Evidence and Logging

Responders should preserve relevant logs, configuration snapshots, timestamps, indicators of compromise, access records, communications, and remediation steps. Evidence should be handled in a way that supports investigation integrity and minimizes unnecessary access to sensitive data.

7. Communications

Incident communications should be accurate, timely, and limited to confirmed facts whenever possible. KONTYRA may notify affected users, customers, partners, service providers, regulators, or law enforcement when required or appropriate.

8. Notification

KONTYRA will evaluate notification obligations based on the type of incident, affected data, applicable laws, contracts, service commitments, and risk to affected individuals or organizations.

9. Lessons Learned

After material incidents, KONTYRA will review what happened, why it happened, how response worked, and what controls or processes should change. Corrective actions may include patches, monitoring improvements, access changes, training, vendor changes, or policy updates.