RepLogix Incident Response Plan

This plan applies to all security incidents affecting RepLogix systems, data, or customers, including unauthorized access, data breaches, malware infections, system compromises, and availability disruptions. It covers incidents involving RepLogix personnel, infrastructure, and third-party service providers.

Incidents are classified by severity:

The Incident Response Team (IRT) is responsible for managing security incidents:

• Incident Commander: Coordinates response, makes critical decisions, authorizes actions
• Security Lead: Performs investigation, identifies scope, documents findings
• Technical Lead: Implements containment and remediation in affected systems
• Communications Lead: Manages internal and external communications, including customer notifications
• Legal/Compliance Advisor: Assesses regulatory and contractual notification obligations

Phase 1 — Detection and Reporting:

• Incidents may be detected through monitoring, alerts, user reports, or third-party notifications
• All personnel are responsible for reporting suspected incidents immediately
• Reports are logged and triaged by the Security Lead

Phase 2 — Assessment and Classification:

• The IRT assesses scope, severity, and impact
• Incidents are classified (P1–P4) and response is initiated accordingly
• Initial findings are documented in an incident record

Phase 3 — Containment:

• Immediate actions are taken to limit damage and prevent spread
• Affected systems may be isolated, accounts disabled, or access blocked
• Evidence is preserved for investigation

Phase 4 — Eradication and Recovery:

• Root cause is identified and remediated
• Affected systems are restored from known-good state
• Vulnerabilities are patched and controls strengthened
• Systems are validated before returning to normal operation

Phase 5 — Post-Incident Review:

• A post-incident review is conducted within 2 weeks of resolution
• Lessons learned are documented and action items are tracked
• Controls and processes are updated to prevent recurrence

Customers are notified of security incidents affecting their data in accordance with contractual and legal obligations:

• Notifications describe the nature of the incident, data affected, and remediation steps
• Notifications are sent without unreasonable delay, consistent with legal requirements
• For schools and districts under a DPA, notification timelines follow the agreement's terms
• Regulatory notifications (e.g., state breach notification laws) are filed as required

Each incident is documented with:

• Incident timeline and discovery details
• Classification and scope assessment
• Actions taken during each response phase
• Customer and regulatory notifications
• Root cause analysis and remediation actions
• Post-incident review findings

Incident records are retained for a minimum of 2 years.

• The Incident Response Plan is reviewed and updated at least annually
• Tabletop exercises are conducted periodically to test response procedures
• IRT members receive training on their roles and the latest threat landscape

To report a security incident, contact: