Incident Response Service Level Agreement

1. Purpose

This document defines the formal service level agreements (SLAs) governing AegisGate Security, LLC’s incident response operations. It establishes severity-based response targets, escalation procedures, and accountability standards to ensure timely, consistent, and transparent handling of security incidents across all AegisGate products and services.

This policy is a companion to the Breach Notification Policy and should be read in conjunction with that document.

2. Scope

This SLA applies to all security incidents affecting AegisGate systems, data, customers, and operations, including but not limited to:

• Unauthorized access or attempted access to systems or data
• Malware infections, ransomware, or other malicious code execution
• Denial-of-service attacks
• Data leakage or exposure
• Vulnerability exploitation
• Configuration errors with security implications
• Third-party vendor incidents impacting AegisGate services

3. Severity Classification

All security incidents are classified according to the following severity levels based on their scope, impact, and urgency.

4. SLA Targets

The following table defines the response and resolution targets for each severity level. All times are measured from the moment an incident is formally triaged and assigned a severity level.

Definitions:

• Initial Response: Time from triage to first actionable response by the incident response team, including acknowledgment, initial assessment, and containment measures.
• Status Update: Maximum interval between proactive updates to affected stakeholders, including internal leadership and impacted customers.
• Resolution Target: Target time to achieve full resolution, defined as containment, remediation, and restoration of normal operations. Extended investigations may exceed this target with CISO approval.
• Escalation: Time within which the designated escalation contacts must be notified.

5. Communication Channels

5.1 Incident Reporting

All security incidents, vulnerabilities, or suspicious activity should be reported immediately through the following channels:

• Email: security@aegisgatesecurity.io
• PGP Key: Available at /security/pgp-key/ — All sensitive reports should be encrypted using our published PGP key
• Bug Bounty Program: For responsible disclosure of vulnerabilities, see our security disclosure policy

5.2 Internal Communications

During an active incident, the Security Operations team will use the following channels, selected based on severity:

5.3 Customer Communications

Customer-facing communications during incidents will follow the protocols established in the Breach Notification Policy, including the 72-hour regulatory notification requirement where applicable.

6. Escalation Procedures

6.1 Automatic Escalation

Incidents are automatically escalated under the following conditions:

• SLA breach: Any SLA target missed by more than 25% triggers automatic escalation to the next severity level’s contacts
• Scope expansion: An incident whose impact widens significantly (e.g., Sev-3 expands to affect multiple customers) is immediately re-triaged at a higher severity
• Customer-reported incidents: Any incident reported by a customer is escalated one severity level from its initial classification for the first 4 hours, ensuring heightened visibility

6.2 Escalation Chain

Sev-4 (Low)        → Engineering on-call → Engineering Lead
Sev-3 (Medium)     → Security Operations → Engineering Lead (within 8 hours)
Sev-2 (High)       → Security Operations → Engineering Lead (within 2 hours) → VP Engineering
Sev-1 (Critical)   → Security Operations → CISO + VP Engineering (within 30 min) → CEO (if SLA breached)

6.3 External Escalation

When external support is required, the following escalation paths are available:

• Legal counsel: Engaged for any Sev-1 or Sev-2 incident with potential regulatory implications
• Law enforcement: Coordinated through legal counsel for criminal activity
• Third-party incident response: Pre-approved forensic firms available on retainer for Sev-1 incidents
• Regulatory bodies: Notification per the Breach Notification Policy and applicable regulations (GDPR Article 33, CCPA, etc.)

7. Post-Incident Review

7.1 Mandatory Reviews

Post-incident reviews are mandatory for all incidents classified as Critical or High severity. Reviews must be completed within 5 business days of incident resolution.

7.2 Review Requirements

Each post-incident review must include:

• Incident timeline: Detailed chronological record from detection to resolution
• Root cause analysis: Identification of the underlying cause and contributing factors
• Impact assessment: Scope of data, systems, and customers affected
• Response evaluation: Assessment of SLA compliance and response effectiveness
• Remediation actions: Specific, assigned, and tracked corrective actions with deadlines
• Process improvements: Recommendations for preventing recurrence or improving response

7.3 Optional Reviews

Medium and Low severity incidents may receive a post-incident review at the discretion of the Security Operations team or Engineering Lead. Reviews are recommended for any incident that:

• Involved novel attack vectors
• Revealed gaps in detection or response capabilities
• Required escalation beyond the initial severity level

8. Metrics and Reporting

8.1 Key Performance Indicators

AegisGate tracks the following incident response metrics on a continuous basis:

8.2 Reporting Cadence

8.3 Targets

9. Relationship to Breach Notification Policy

This Incident Response SLA operates in parallel with the Breach Notification Policy. Key intersections include:

• 72-Hour Regulatory Notification: Where an incident constitutes a reportable breach under applicable law (GDPR Article 33, CCPA, etc.), the Breach Notification Policy’s 72-hour notification requirement applies regardless of the incident’s resolution target under this SLA.
• Severity Alignment: A Critical (Sev-1) incident involving confirmed data exfiltration or unauthorized access to personal data will trigger the Breach Notification Policy’s notification workflow in parallel with this SLA’s response procedures.
• Communication Overlap: Customer notifications issued under the Breach Notification Policy satisfy the status update requirements of this SLA for the corresponding time period.

10. Policy Review

This SLA is subject to quarterly review by the Security Operations team and CISO. Reviews will assess:

• SLA compliance trends and target adjustments
• Severity classification criteria adequacy
• Escalation procedure effectiveness
• Emerging threat landscape considerations

Any material changes to this SLA will be communicated to affected customers within 30 days.

This document is maintained by AegisGate Security, LLC. For questions, contact security@aegisgatesecurity.io.