Lead Validator Pro Lead Validator Proby Resolon

Incident Response Plan

Version 1.1 — Effective Date: May 20, 2026   Last Reviewed: May 20, 2026

This Incident Response Plan (IRP) establishes procedures for detecting, containing, eradicating, and recovering from security incidents affecting the Lead Validator Pro platform and the personal data we process on behalf of our customers.

1. Response Phases

PHASE 1
Detection
→
PHASE 2
Containment
→
PHASE 3
Eradication
→
PHASE 4
Recovery
→
PHASE 5
Notification

Phase 1: Detection

Incidents may be detected through the following channels:

Action: Log the detection event, assign initial severity level, and notify the Incident Commander.

Phase 2: Containment

Immediate actions to limit the scope and impact of the incident:

Phase 3: Eradication

Remove the root cause of the incident:

Phase 4: Recovery

Restore systems to normal operation:

Phase 5: Notification

Notify affected parties in accordance with applicable law and contractual obligations:

Notification Timelines

2. Severity Levels

LevelDescriptionExamplesResponse TimeEscalation
P1 - Critical Active data breach, system compromise, or complete service outage affecting all customers Confirmed PII exfiltration, database compromise, ransomware, unauthorized admin access Immediate (within 15 min) CEO, CTO, Legal; affected Customers notified within 24 hrs of Breach confirmation per DPA § 11
P2 - High Potential data exposure, partial service degradation, or targeted attack in progress Brute force attack succeeding, API key leak, SQL injection attempt succeeding, single-tenant data exposure Within 1 hour CTO, Security team, affected customer(s)
P3 - Medium Security vulnerability discovered, failed attack detected, non-critical service issues Vulnerability in dependency, failed brute force (blocked), intermittent API errors, misconfiguration Within 4 hours Security team, Engineering lead
P4 - Low Minor security concern, policy violation, informational alert Unusual login pattern (resolved), expired certificate warning, non-sensitive log exposure Within 24 hours Security team (logged for review)

3. Incident Response Team

RoleResponsibilities
Incident CommanderCoordinates response, makes containment decisions, manages timeline, approves communications
Security LeadTechnical investigation, forensic analysis, vulnerability assessment, evidence preservation
Engineering LeadSystem remediation, patching, deployment, recovery operations
Communications LeadDrafts customer notifications, coordinates with legal, manages external communications
Legal CounselRegulatory compliance, breach notification requirements, law enforcement liaison

4. Communication Templates

4.1 Initial Internal Alert (P1/P2)

INTERNAL INCIDENT ALERT
SEVERITY: [P1/P2/P3/P4] DETECTED: [Date/Time UTC] DETECTED BY: [Monitoring system / Person] DESCRIPTION: [Brief description of what was detected] AFFECTED SYSTEMS: [List of affected systems, services, databases] AFFECTED DATA: [Types of data potentially affected] [Estimated number of records/customers] INITIAL CONTAINMENT: [Actions taken immediately] NEXT STEPS: [Immediate action items] INCIDENT COMMANDER: [Name] WAR ROOM: [Channel/Location]

4.2 Customer Breach Notification (24-hour)

CUSTOMER BREACH NOTIFICATION
Subject: Security Incident Notification - Lead Validator Pro Dear [Customer Name], We are writing to inform you of a security incident that may have affected data processed by Lead Validator Pro on behalf of your organization. WHAT HAPPENED: On [date], we detected [brief description of the incident]. The incident was contained on [date]. WHAT DATA WAS INVOLVED: [Categories of data affected, e.g., "lead contact information including names, phone numbers, and email addresses"] Approximately [number] records associated with your organization may have been affected. WHAT WE ARE DOING: - [Containment actions taken] - [Investigation status] - [Remediation measures implemented] - [Third-party forensic engagement, if applicable] WHAT YOU CAN DO: - Review your audit logs for any unusual activity - Notify affected consumers as required by applicable law - Contact us with questions at security@leadvalidatorpro.com We take this incident seriously and are committed to transparency throughout the investigation. We will provide updates as additional information becomes available. Sincerely, Lead Validator Pro Security Team security@leadvalidatorpro.com

4.3 Consumer Notification (CCPA - 30 day)

CONSUMER BREACH NOTIFICATION (CCPA)
Subject: Notice of Data Breach Dear [Consumer Name], We are writing to notify you that your personal information may have been involved in a data security incident. WHAT HAPPENED: [Description of the breach in plain language] WHAT INFORMATION WAS INVOLVED: [Specific data elements, e.g., "your name, phone number, email address, and home address"] WHAT WE ARE DOING: [Remediation steps taken] WHAT YOU CAN DO: - Monitor your accounts for suspicious activity - Consider placing a fraud alert with credit bureaus - You may obtain a free credit report at www.annualcreditreport.com FOR MORE INFORMATION: Contact our Privacy Office at: Email: privacy@leadvalidatorpro.com Phone: [Phone Number] You may also contact the California Attorney General at: Office of the Attorney General 1300 I Street, Sacramento, CA 95814 www.oag.ca.gov Sincerely, Resolon LLC

5. Post-Incident Review

Within 5 business days of incident resolution, the Incident Response Team shall conduct a post-incident review ("post-mortem") covering:

  1. Timeline: Complete chronology from detection through resolution
  2. Root Cause Analysis: Technical root cause and contributing factors
  3. Impact Assessment: Scope of data affected, systems compromised, service disruption duration
  4. Response Evaluation: Effectiveness of detection, containment, and communication
  5. Lessons Learned: What worked well, what needs improvement
  6. Action Items: Specific remediation tasks with owners and deadlines
  7. IRP Updates: Changes to this plan based on lessons learned

6. Testing and Maintenance

7. Regulatory Reference

Key Compliance Requirements: