Incident Response Plan

1. Purpose & Scope

This Incident Response Plan (IRP) defines the process for identifying, containing, eradicating, and recovering from security incidents affecting Hypernova AI Inc. systems, data, and customers.

This plan applies to all security events including unauthorized access, data breaches, malware infections, denial of service attacks, and insider threats.

2. Severity Classification

P1 — Critical

Response: <1 hour

Data breach, ransomware, complete system compromise, PHI/PII exposure. All hands response required.

P2 — High

Response: <4 hours

Partial system compromise, unauthorized privileged access, significant service disruption.

P3 — Medium

Response: <24 hours

Suspicious activity, minor unauthorized access, policy violations, failed intrusion attempts.

P4 — Low

Response: <72 hours

Minor anomalies, low-impact policy deviations, informational security events.

3. Response Phases

1

Preparation

Maintain up-to-date contact list for incident response team. Ensure runbooks, tooling, and access credentials are available offline. Maintain offsite data backups verified monthly. Security monitoring (logs, alerts) active 24/7 via Cloudflare and server audit logs.

2

Detection & Analysis

Security events may be detected via: automated monitoring alerts, customer reports, responsible disclosure reports, or routine log review. Upon detection:

Acknowledge the alert and begin triage within the severity SLA window
Assess scope: systems affected, data types involved, users impacted
Assign severity level (P1–P4) and escalate to Security Officer immediately
Document all findings with timestamps

3

Containment

Short-term containment: Isolate affected systems, revoke compromised credentials, block malicious IPs via Cloudflare, disable affected accounts. Preserve evidence: take system snapshots and log backups before remediation. Determine if an ongoing threat actor has persistence.

4

Eradication

Identify and remove the root cause: patch the exploited vulnerability, remove malware, revoke all compromised credentials (not just the discovered ones), audit for additional backdoors. Verify eradication before proceeding to recovery.

5

Recovery

Restore service from known-good backups where applicable. Verify data integrity after restoration. Monitor systems closely for 72 hours post-recovery. Gradually restore access, starting with low-privilege accounts. Confirm service is operating normally before declaring the incident resolved.

6

Post-Incident Review

Within 5 business days of resolution, conduct a Post-Incident Review meeting. Document: timeline, root cause, impact, response effectiveness, and lessons learned. Update runbooks, policies, and technical controls as needed. Track remediation items to completion.

4. Notification Requirements

Regulation	Trigger	Timeline	Recipient
GDPR	Personal data breach likely to result in risk to individuals	`72 hours` of becoming aware	Supervisory Authority + affected data subjects
HIPAA	Breach of unsecured Protected Health Information (PHI)	`60 days` of discovery	Affected individuals + HHS (and media if >500 in a state)
CCPA	Breach of personal information not encrypted or redacted	Expedient notice	Affected California consumers
Customer Notification	Any breach affecting customer data	Within `72 hours` of confirmation	All affected customers via email

5. Escalation Chain

Contact & Escalation

First Contact: [email protected] — monitored by CEO
Security Officer / CEO: Cale McMillin — ultimate decision authority on incident response
P1 Incidents: CEO must be notified immediately by any available channel
Legal Counsel: Engaged for P1/P2 incidents involving personal data breaches
External IR Firm: Engaged for P1 incidents requiring forensic investigation

Document Control

Version	Date	Author	Changes
1.0	January 1, 2026	Cale McMillin	Initial document
1.0.1	August 2026	Cale McMillin	Annual review — no material changes