Ends in --d --h --m --sNow launching: the Calenix Founders Lifetime Deal, one payment for lifetime access, reserved for our early members. Claim your lifetime access →

Incident Management and Response Policy

This policy establishes Calenix's framework for identifying, assessing, containing, investigating, remediating and learning from security incidents.

1. Incident Definition

An incident is any confirmed or suspected event that compromises the confidentiality, integrity, or availability of the Service or customer data.


A security incident may include:

  1. unauthorised access;
  2. suspected account compromise;
  3. credential exposure;
  4. malware;
  5. data leakage;
  6. unauthorised disclosure;
  7. loss of sensitive information;
  8. malicious code;
  9. denial-of-service activity;
  10. exploitation of a vulnerability;
  11. suspicious system activity;
  12. unauthorised changes;
  13. compromise of third-party credentials; or
  14. any other event that may materially affect confidentiality, integrity or availability.

2. Incident Response Objectives

Calenix's objectives are to:

  1. protect users and customer information;
  2. contain the incident;
  3. preserve relevant evidence;
  4. restore secure operations;
  5. meet applicable notification obligations;
  6. identify root causes; and
  7. prevent recurrence.

3. Incident Classification

Incidents may be classified according to:

  1. severity;
  2. scope;
  3. affected systems;
  4. data involved;
  5. number of affected users;
  6. likelihood of harm;
  7. operational impact; and
  8. regulatory or contractual implications.

4. Response Process

Calenix generally follows these stages:


Identification

Potential incidents are identified through:

  1. monitoring;
  2. alerts;
  3. vulnerability reports;
  4. employees;
  5. customers;
  6. vendors;
  7. security researchers; and
  8. other credible sources.


Triage

The incident is evaluated to determine:

  1. what occurred;
  2. which systems are affected;
  3. whether the incident is ongoing;
  4. what information may be involved;
  5. potential impact; and
  6. appropriate containment measures.


Containment

Calenix may:

  1. disable compromised accounts;
  2. revoke credentials;
  3. isolate systems;
  4. block traffic;
  5. suspend integrations;
  6. deploy security controls; or
  7. otherwise limit the incident's impact.


Investigation

Calenix may analyse:

  1. system logs;
  2. authentication events;
  3. network activity;
  4. application activity;
  5. configuration changes;
  6. access records; and
  7. other relevant evidence.


Remediation

Calenix addresses the underlying cause, which may include:

  1. patching vulnerabilities;
  2. changing credentials;
  3. modifying configurations;
  4. improving access controls;
  5. removing malicious code;
  6. updating software; or
  7. implementing additional monitoring.


Recovery

Systems are restored to normal operation after appropriate security checks.


Post-Incident Review

Material incidents may be reviewed to identify:

  1. root cause;
  2. contributing factors;
  3. control failures;
  4. response effectiveness;
  5. required remediation; and
  6. improvements to policies or procedures.

5. Customer Notification

Where required by applicable law or contractual obligations, Calenix will notify affected customers or individuals of qualifying incidents.


Notifications may include, where reasonably available:

  1. description of the incident;
  2. categories of information involved;
  3. known or suspected impact;
  4. actions taken by Calenix;
  5. steps users can take to protect themselves; and
  6. contact information for further questions.


Calenix may delay notification where legally permitted and reasonably necessary to avoid compromising an investigation, security response or legal obligation.

6. Third-Party Incidents

Where an incident occurs at a third-party provider that affects Calenix or customer information, Calenix will assess the provider's notification and remediation information and take reasonable steps to mitigate resulting risk.

7. Evidence Preservation

Calenix may preserve relevant records and evidence necessary for:


  1. incident investigation;
  2. legal obligations;
  3. regulatory obligations;
  4. insurance;
  5. dispute resolution; or
  6. security improvement.

8. Confidentiality

Incident information is shared internally on a need-to-know basis and externally only where appropriate or required.

9. Continuous Improvement

Material incidents may result in updates to:

  1. security controls;
  2. vulnerability management;
  3. infrastructure;
  4. access controls;
  5. monitoring;
  6. employee training;
  7. incident procedures; and
  8. technical architecture.