This Incident Response Plan ("IRP") establishes RAVEN's procedures for identifying, containing, eradicating, and recovering from security incidents affecting the platform or customer information. It is designed to satisfy RAVEN's obligations under the GLBA Safeguards Rule (16 CFR §314.4(h)), state breach-notification laws, the FFIEC Information Security Handbook, and the notification commitments in our Customer Agreement.
2. Scope
This IRP applies to any actual or reasonably suspected event that may compromise the confidentiality, integrity, or availability of:
Consumer data processed through the platform
Customer (bank) operational data or credentials
RAVEN production systems, source code, or key material
Third-party subprocessor systems that handle data on RAVEN's behalf
3. Roles and Responsibilities
Incident Commander: RAVEN Security Lead. Owns response coordination, decisions on containment and escalation, and external communications. Default: Isaac Welch.
Engineering Lead on Call: Owns technical investigation, containment, eradication, and recovery.
Privacy Officer: Owns consumer-facing communications and rights-request implications. Default: Isaac Welch.
Legal / External Counsel: Engaged for any incident at severity SEV-2 or higher, or whenever notification obligations are likely to be triggered.
Customer Liaison: Owns customer (bank) notification and ongoing coordination with affected institutions.
4. Severity Tiers
SEV-1: Confirmed unauthorized access to or exfiltration of consumer data; production-wide outage; key-material compromise. Page Incident Commander immediately; engage external counsel; prepare customer and regulator notifications.
SEV-2: Probable but unconfirmed compromise; partial production outage; subprocessor incident affecting RAVEN data; credential or access-control failure. Page Incident Commander within 1 hour; begin investigation; prepare for customer notification.
SEV-3: Vulnerability discovered without evidence of exploitation; degraded performance; failed control without data exposure. Triaged within one business day; remediated under change management.
SEV-4: Informational. Logged for the annual report.
5. Response Phases
5.1 Detection and Triage
Incidents are detected through application monitoring, infrastructure alerts, provider notifications, internal reports, and security@reportraven.tech intake. Every report is triaged within one business hour during business hours and within four hours outside business hours. Triage assigns a severity tier and an Incident Commander.
5.2 Containment
Revoke compromised credentials, API keys, and OAuth tokens
Isolate affected services or tenants
Block source IPs or actors where applicable
Suspend production access for any tenant whose credentials are implicated, pending re-attestation
5.3 Evidence Preservation
Capture and preserve logs, snapshots, configuration, and forensic artifacts before remediation actions that would alter them
Maintain a written incident timeline with timestamps for every decision and action
Restrict evidence handling to the Incident Commander and named investigators
5.4 Eradication and Recovery
Remove the root cause (patched vulnerability, rotated key, removed malicious actor)
Validate that the threat has been eliminated through targeted testing
Restore affected services from known-good state
Monitor for recurrence for an explicit post-incident window
5.5 Notification
Customer notification: Affected customers are notified within the time windows required by the Customer Agreement (and in any event no later than the time needed for the customer to satisfy its own GLBA Safeguards Rule and state breach-notification obligations).
Consumer notification: Where direct consumer notification is required, RAVEN supports its customers in meeting their notice obligations, or notifies directly if RAVEN is the notifying party under applicable law.
Regulator notification: Where RAVEN has a direct notification obligation (including NYDFS 23 NYCRR Part 500 §500.17 if applicable), RAVEN notifies within the regulatory window. Notification through customers to their primary regulator is coordinated through the Customer Liaison.
Subprocessor incidents: RAVEN treats subprocessor incidents affecting customer information as RAVEN incidents for notification purposes.
5.6 Post-Incident Review
Within ten business days of incident closure, the Incident Commander conducts a written post-incident review covering root cause, response effectiveness, control gaps, and remediation actions. SEV-1 and SEV-2 reviews are presented to the governing body in the next scheduled WISP review cycle.
6. Testing
This IRP is exercised at least annually through a tabletop exercise covering a realistic scenario (for example, a stolen API key, a subprocessor breach, or a ransomware event). Findings drive updates to this plan.
7. Communications
Internal: incident-response Slack channel; pager for the Engineering Lead on Call
Customer: primary technical and compliance contacts on file for each tenant
Public: status.reportraven.tech (where used) and security@reportraven.tech
8. Contact
Report a security incident: security@reportraven.tech