Incident Response
IR-04Report a material computer-security incident to the bank as soon as possible
How Leela would run itEvent-driven · as soon as possible after determining a disruption of 4 hours or more has occurred or is reasonably likely
From the policy libraryThe requirement
When the Company determines it has experienced a computer-security incident, with or without unauthorized access, that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the services it provides to the sponsor bank for four hours or more, it notifies the bank as soon as possible. The notice is not held for a completed investigation, because it feeds the bank’s own 36-hour notice to its regulator.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Make the four-hour determination on confirmation, send the notice to the bank’s security contacts with what is known, log the time, and supply the details the bank needs for its regulatory notice.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Determination recordTime the four-hour threshold was judged met or likely, and by whom
- 02Bank noticeNotice sent with the time, against the determination time
Evidence
Determination record
Incident Response §5.2, §7.2
2
of 2 records
The work and the records come from this obligation in the policy library.