These instructions put the Information Security Policy and its supporting policies into practice. The CEO assigns responsibilities and records Security Review Team membership; until duties are delegated, the CEO performs them. Keep a dated record of each completed task.
Recurring Work
| When | Action | Keep As Evidence |
|---|---|---|
| On an alert or security report | Assess impact and exposure; contain active compromise. Prioritize critical/high vulnerabilities and assign an owner and target date. | Finding, response, verification, remaining risk. |
| Monthly | Review open risks, alerts, backup status, and alert delivery. Update actions and review dates. | Dated risk review and follow-ups. |
| Quarterly | Review sensitive access across inventoried systems: roles, groups, service identities, and MFA. Remove stale access, sample access approval/removal records, and reconcile the asset inventory. | Reviewer, systems/assets checked, changes, findings. |
| Every six months | CEO and Security Review Team review policies, procedures, findings, and corrective actions; approve and communicate changes. | Participants, decisions, versions, follow-ups. |
| Before granting access | Record identity, system, need, role, and CEO or system-owner approval. Confirm MFA, confidentiality obligations, policy acknowledgment, and training before sensitive access. | Approval and acknowledgment/training record. |
| On departure, role change, or compromise | Immediately revoke unnecessary access and sessions; rotate affected secrets. Recover equipment and remove company information as appropriate, preserving required records. | Completed access/asset checklist. |
| Before asset use, reassignment, or disposal | Approve and record the asset, owner, sensitivity, and safeguards. Verify handover or secure data removal before reuse/disposal. | Inventory update and completion record. |
| Before a sensitive deployment | Review and test the change, identify recovery steps, deploy through the approved path, and check health/alerts. | Release, review, checks, result. |
| Before vendor/data-flow changes; annually for material vendors | Review purpose, data, locations, retention/deletion, access, and security terms. Approve before sharing sensitive information. | Inventory entry and approval. |
| Before AI features or material model changes | Review impact and test input boundaries, authorization, prompt-injection defenses, internal calculations, hosting/retention settings, and rollback under the AI policy. | Approved scope/model/settings and evaluation results. |
| At onboarding and annually | Cover phishing, MFA, secrets, device security, safe AI use, data handling, and incident reporting. Confirm understanding. | Training and acknowledgment record. |
| Annually; also on relevant role changes | Review personnel security responsibilities, training, and corrective actions. CEO covers ongoing contractors and their own duties where no separate manager is designated. | Restricted personnel review and completion evidence. |
| Before production use and annually | Restore a representative backup in isolation; verify usable data, record recovery time, and securely remove test copies. Update recovery instructions after material changes. | Restore scope, steps, elapsed time, result. |
Vulnerability Scanning And Patching
The founder confirms vulnerability-scanning software is implemented. Record the actual tools, account settings, asset enrollment, and dated results in restricted evidence. The recommended coverage pattern is Fleet for work computers, Amazon Inspector for supported AWS workloads and container images, and GitHub Dependabot for repository dependencies; the exact deployed product names have not been independently checked.
- Cover: Reconcile every employee/contractor work computer and production asset against the inventory. Enroll devices, enable eligible cloud/image scans, and check dependency alerts. Record a suitable assessment for assets a tool cannot scan; do not silently exclude them. Review scan health and coverage weekly and after asset changes.
- Find: Run automated scans at least weekly and after material changes; use continuous rescanning where supported. Review alerts and vendor advisories daily so the release-based critical deadline can be met. Track supported versions and announced EOL dates monthly, independently of version freshness.
- Fix: Assign each applicable finding an owner and deadline. Install critical security fixes within 24 hours of vendor patch release; contain critical exposures immediately. Keep packages, frameworks, and tools within six months of the latest stable release and replace EOL software before support ends. Record risk-based deadlines for other findings. If a fix is unavailable or a deadline cannot be met, document mitigation and seek a time-limited CEO exception without marking the SLA met.
- Verify: Rescan or otherwise verify remediation. Keep asset coverage, last successful scan, finding, patch release time, deadline, installed version/time, and verification result. Escalate overdue findings to the CEO.
Tool selection, limits, and rollout evidence are described in the scanning research brief.
Privacy, Retention, And Disposal
Display the current privacy notice in the app before collection and obtain the permissions/consent required for the requested financial-data flow. Record the notice version and authorization; obtain additional consent when scope expands. Do not equate general policy acceptance with every required permission.
For account deletion, immediately disable access, revoke sessions, disconnect bank access, and stop collection and sync jobs. Locate linked records across identity and financial stores, caches, files, queues, logs, backups, and vendors. Apply the retention schedule, record any lawful retention exception, and complete earlier deletion where required. Check due disposals monthly; verify deletion or irreversible anonymization, vendor requests, and backup expiry. Reapply deletions after a restore. Keep a minimal completion record, not a copy of deleted financial data.
Incident Response
The CEO leads the response or designates an incident lead. Assess notification obligations from the start and coordinate any handover.
- Report: Report immediately to the CEO through [email protected] or direct contact if email is unavailable. Record discovery time, affected systems, and suspected exposure.
- Contain: Treat suspected customer-data exposure, leaked credentials, or active intrusion as urgent. Restrict access, revoke credentials, or stop affected integrations.
- Preserve: Secure relevant logs, request IDs, and release details. Keep customer data and secrets out of shared chat and tickets.
- Recover: Remove the cause, patch or rotate credentials, restore if needed, and verify safe operation and data integrity.
- Notify: Notify our data providers promptly of breaches or unauthorized use affecting their accounts or data, following contractual reporting requirements. The CEO coordinates required customer, regulator, and other legal notifications. Do not wait for recovery or a complete investigation when a notification is due.
- Learn: Record the timeline, impact, root cause, actions, and notifications. Assign corrective actions, update the risk register, and verify completion.
Production Readiness
Before production, verify access/MFA, encryption and secrets, data-provider webhook verification, safe logging and alert delivery, asset inventory, backups and a successful restore, retention/deletion, and approved vendor data flows. Run an incident exercise and test external delivery to the security contact.
For AI features, reconcile deployed routing and input handling with the AI policy: only approved redacted customer summaries through Bedrock, no customer data in coding tools, and internal non-AI calculations and forecasts. Verify implementation rather than inferring it from an account or draft policy.
Record results in control status. Put unfinished work, an owner, next action, and review date in the risk register.
Records And Exceptions
Keep evidence in restricted storage with date, reviewer, scope, result, and follow-ups. Link completion records without copying secrets, raw customer data, or private personnel reviews here. The CEO approves exceptions with safeguards and a review or expiry date.