Security, Infrastructure & OperationsIncident Management
Incident Response Procedure
Classification, detection, response, escalation, and post-incident analysis
The incident response procedure defines how security or availability events on the SSM.ro platform are detected, classified, handled, and analyzed.
Incident classification
| Severity | Description | Examples |
|---|---|---|
| Critical (P1) | Total service unavailability or confirmed data compromise | Production outage, credential compromise, data breach |
| Major (P2) | Significant degradation or high risk | Sharp increase in errors, partial unavailability |
| Minor (P3) | Limited impact, no data affected | Isolated malfunctions, non-critical errors |
Detection
Incidents are detected through the monitoring stack:
- New Relic — NRQL alerts on error rates and Ping Monitor (Critical alert on endpoint unavailability)
- Sentry — email alerts on new runtime exceptions or regressions
- Provider status — monitoring
status.heroku.comand AWS service health
Details: Metrics and Alerts.
Response steps
- Identification — the alert is received and confirmed
- Triage and classification — severity and impact are established
- Containment/limitation — impact is limited (e.g. rollback of a defective release, credential rotation)
- Remediation — the fix is applied (data restoration, patch, service restart)
- Notification — tenants and/or authorities are informed per the notification procedure
- Verification — return to normal and data integrity are confirmed
- Post-incident analysis — written review and corrective actions
Response to specific scenarios
| Scenario | Immediate action |
|---|---|
| Defective release | One-click Heroku rollback (< 30 min) |
| Credential compromise | Immediate rotation of all secrets (Heroku config vars, AWS keys, Postmark/e-signature provider tokens); log review; notification if customer data is affected (< 2 hours) |
| Data loss | Restoration from PITR/snapshot (Postgres) or versioning/CRR (S3) |
| Personal data breach | Activation of the GDPR data breach notification procedure |
Escalation
P1/P2 incidents are escalated to the responsible technical team and, where applicable, to management and the DPO (for personal data). Communication to customers is done via email and status updates.
Post-incident analysis (post-mortem)
For any event with production impact:
- Written review — causes, impact, timeline, actions taken
- Corrective actions — identified and tracked through to implementation
- Procedure updates — lessons learned integrated into SOPs
Major incidents with public impact are recorded in the Incident History.