Incident Response Policy

1. Purpose

The goal of this policy is to clearly identify the IT roles and responsibilities of Xpert Group FZE-LLC ("the Company") for the investigation of and response to computer security incidents and data breaches affecting the Company and the SignSyncer platform.

The policy exists so that when something goes wrong, everyone knows who leads, who decides, who communicates, and what happens in which order — without needing to work it out under pressure.

2. Scope

This policy applies to all personnel, including employees, temporary workers, contractors, those employed by contracted entities, and others authorised to access Company information resources, regardless of the ownership or location of the information systems used to store, process, transmit, or access Company data.

It covers all incidents affecting signsyncer.com, app.signsyncer.com, the supporting APIs and infrastructure, Company corporate systems, and any data processed on behalf of customers.

3. Definitions

4. Responsibilities

5. How to Report an Incident

A suspected or confirmed security incident must be reported immediately, and in any case within one hour of discovery, using one of the following channels:

The report should describe what happened, when it was noticed, which systems or data appear to be affected, and what the reporter has already done. Reporters must not attempt to investigate, remediate, or delete evidence themselves unless instructed by the Security Officer.

External security researchers should report through the Vulnerability Disclosure Policy.

6. Severity Classification

The Security Officer assigns a severity at triage. Severity may be revised as more is learned.

7. Response Procedure

In the case of a security incident, the following steps are taken by the security responsible person towards resolution. Each step is recorded in the incident log with a timestamp and the name of the person who performed it.

8. Notification Obligations

Where an incident involves personal data or customer data, the following notification timelines apply. Legal advises on which apply in each case; the Security Officer executes them.

Notifications describe the nature of the incident, the categories and approximate number of individuals and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information.

9. Evidence Handling and Forensics

• Preserve before you fix. Take copies of logs, memory, and disk images where practical before remediating, and record who took them and when.
• Do not power off a compromised system unless instructed; volatile evidence may be lost.
• Maintain a chain of custody for any evidence collected, recording each person who handled it and the date and time.
• Store evidence encrypted, with access limited to the IRT and any appointed forensic investigator.
• Where cyber insurance is in place, the insurer's appointed forensic investigators will determine how the breach occurred, the types of data involved, the number of individuals and organisations impacted, and the root cause.
• Retain incident records for a minimum of 3 years.

10. Post-Incident Review

A post-incident review is held within 10 business days of closing any P1 or P2 incident, and at the Security Officer's discretion for P3 and P4.

The review is blameless and covers: the timeline of events, how the incident was detected and how long detection took, what worked, what did not, the root cause, contributing factors, and the corrective actions required. Each corrective action is given an owner and a due date, and is tracked to closure by the Security Officer. Findings feed back into the Information Security Policy and the risk register.

11. Testing and Training

• The Incident Response Team conducts a table-top exercise at least annually, simulating a realistic scenario such as a leaked OAuth token or a compromised administrator account.
• The exercise tests the contact tree, the decision path, the containment steps, and the notification timelines. Findings are documented and used to update this policy.
• Contact details in Section 4 are verified at least quarterly and updated immediately on any personnel change.
• All personnel receive incident reporting training on joining and annually thereafter, so that everyone knows how to raise an incident and what not to do.