Security · Completed
Incident Response Plan
Researcher on a 5-person team that built an executive-level incident response plan for a fictional company, Apomi Insurance.
Incident responseBreach notificationComplianceCommunicationsTeamwork
The assignment
Build an incident response plan and present it to executives as if we were the security team at Apomi Insurance, a fictional insurer that handles sensitive customer data.
My part
I was the team's researcher. I co-wrote the company profile and owned three sections of the plan:
- Internal communication: who gets told what, and when, inside the company during an incident
- External communication and regulators: how and when to notify customers, partners, and regulators
- 30-day notification timeline: a day-by-day roadmap that keeps the company inside breach-notification deadlines
Why it matters
Technical response is only half of an incident. Companies often get hurt most by slow or messy communication and missed legal deadlines. This project taught me how the business, legal, and technical sides of a breach fit together.