Incident response and recovery.
The incident-response framework defines triage, containment, evidence preservation, decision authority, notification, recovery and post-incident review.
Record status
Owner: BLACK& technology and governance functions. Version: 1.0. Public status: response framework. Last reviewed: 15 July 2026.
Response sequence
A reported event is recorded, assessed for severity and assigned an accountable owner. Response can include containment, access revocation, provider escalation, evidence preservation, recovery and controlled communication.
Notification
Legal, contractual and stakeholder notification decisions depend on the confirmed scope, affected data or service, risk and applicable reporting deadline. Public statements are not issued before material facts and authority are established.
Recovery and review
Recovery verifies service integrity before normal operation resumes. A material incident receives a post-incident review covering root cause, control changes, owner, deadline and evidence of completion.
Report an incident
Send a concise initial report to hq@blackandi.com with the subject ‘Security — Confidential’. Do not include credentials or unnecessary protected information in the first message.