Incident Management and Response Policy

Calenix's objectives are to:

1. protect users and customer information;
2. contain the incident;
3. preserve relevant evidence;
4. restore secure operations;
5. meet applicable notification obligations;
6. identify root causes; and
7. prevent recurrence.

Incidents may be classified according to:

1. severity;
2. scope;
3. affected systems;
4. data involved;
5. number of affected users;
6. likelihood of harm;
7. operational impact; and
8. regulatory or contractual implications.

Calenix generally follows these stages:

Identification

Potential incidents are identified through:

1. monitoring;
2. alerts;
3. vulnerability reports;
4. employees;
5. customers;
6. vendors;
7. security researchers; and
8. other credible sources.

Triage

The incident is evaluated to determine:

1. what occurred;
2. which systems are affected;
3. whether the incident is ongoing;
4. what information may be involved;
5. potential impact; and
6. appropriate containment measures.

Containment

Calenix may:

1. disable compromised accounts;
2. revoke credentials;
3. isolate systems;
4. block traffic;
5. suspend integrations;
6. deploy security controls; or
7. otherwise limit the incident's impact.

Investigation

Calenix may analyse:

1. system logs;
2. authentication events;
3. network activity;
4. application activity;
5. configuration changes;
6. access records; and
7. other relevant evidence.

Remediation

Calenix addresses the underlying cause, which may include:

1. patching vulnerabilities;
2. changing credentials;
3. modifying configurations;
4. improving access controls;
5. removing malicious code;
6. updating software; or
7. implementing additional monitoring.

Recovery

Systems are restored to normal operation after appropriate security checks.

Post-Incident Review

Material incidents may be reviewed to identify:

1. root cause;
2. contributing factors;
3. control failures;
4. response effectiveness;
5. required remediation; and
6. improvements to policies or procedures.

Where required by applicable law or contractual obligations, Calenix will notify affected customers or individuals of qualifying incidents.

Notifications may include, where reasonably available:

1. description of the incident;
2. categories of information involved;
3. known or suspected impact;
4. actions taken by Calenix;
5. steps users can take to protect themselves; and
6. contact information for further questions.

Calenix may delay notification where legally permitted and reasonably necessary to avoid compromising an investigation, security response or legal obligation.

Where an incident occurs at a third-party provider that affects Calenix or customer information, Calenix will assess the provider's notification and remediation information and take reasonable steps to mitigate resulting risk.

Calenix may preserve relevant records and evidence necessary for:

1. incident investigation;
2. legal obligations;
3. regulatory obligations;
4. insurance;
5. dispute resolution; or
6. security improvement.

Incident information is shared internally on a need-to-know basis and externally only where appropriate or required.

Material incidents may result in updates to:

1. security controls;
2. vulnerability management;
3. infrastructure;
4. access controls;
5. monitoring;
6. employee training;
7. incident procedures; and
8. technical architecture.