INCIDENT RESPONSE PLAN

Redline Design - Incident Response Plan 1. Introduction & Purpose This Incident Response Plan (IRP or "Plan") establishes the framework for Redline Design to respond to and manage security incidents in a timely, effective, and coordinated manner. The primary goal is to minimize the adverse impact of such incidents on Redline Design's operations, assets, reputation, and its clients. The purpose of this IRP is to establish procedures for prompt incident detection, analysis, containment, eradication, and recovery; define roles and responsibilities for the Incident Response Team (IRT); ensure compliance with all legal and regulatory obligations; and facilitate a post-incident review process for continuous improvement. The scope of this plan applies to all suspected or confirmed security incidents affecting Redline Design's information systems, data, and services. 2. Roles, Responsibilities, and Contact Information (Incident Response Team - IRT) A pre-defined Incident Response Team (IRT) is established to ensure an organized and efficient response. An up-to-date contact list for all IRT members and external resources shall be maintained and be readily accessible.  Incident Response Coordinator/Manager (IRC), Technical Lead(s), Communications Lead, Human Resources (HR) Lead: Ryan Howard: 208-867-4526, Ryan@redline.design.  3. Incident Classification and Severity Levels A security incident is any adverse event that threatens the confidentiality, integrity, or availability of Redline Design's information assets. Incidents are classified by severity to guide the response. Critical (Extreme): Catastrophic impact posing an imminent threat to business operations or resulting in massive data loss. Requires immediate IRT activation and escalation to executive management. High: Severe impact causing significant disruption to critical services or compromise of sensitive client data. Requires full IRT activation and escalation. Medium: Moderate impact with localized disruption or minor data exposure. Core IRT members are activated. Low: Minimal impact with no data loss and easily contained. Handled by IT support with documentation. The IRC is responsible for assigning and re-evaluating the severity level of an incident. 4. Incident Response Phases Redline Design adopts a structured, six-phase approach to incident response. Phase 1: Preparation: This ongoing phase includes maintaining this IRP, training the IRT, acquiring necessary tools, and conducting regular response exercises. Phase 2: Identification: This phase involves detecting and verifying a security incident from sources like security alerts or employee reports. All suspected incidents must be reported immediately. All actions from this point forward must be meticulously logged. 

Phase 3: Containment: The goal is to limit the incident's scope. Short-term actions may include isolating affected systems or disabling compromised accounts. Evidence must be preserved during this phase. Phase 4: Eradication: This phase focuses on eliminating the root cause of the incident, such as removing malware and patching vulnerabilities. Phase 5: Recovery: The objective is to restore affected systems and services to normal, secure operation from clean backups. Restored systems are validated and closely monitored. Phase 6: Post-Incident Activity / Lessons Learned: A post-incident review meeting is held to analyze the incident and the response. A formal report is generated, and the IRP and other security controls are updated based on lessons learned to prevent future incidents. 5. Communication Plan Effective communication is critical during an incident. Internal Communications: The IRT will use designated secure channels. Employees will be notified as needed. The IRC will provide regular updates to executive management for high-severity incidents. External Communications:  Client Notification: If an incident affects client data or services, affected clients will be notified promptly and transparently. Law Enforcement: The decision to involve law enforcement for criminal activity will be made by Legal Counsel and Executive Management. Breach Notification Procedures: Redline Design will comply with all applicable data breach notification laws. Notifications to individuals will be factual and provide clear steps they can take to protect themselves. 6. Legal and Regulatory Considerations The IRT, led by Legal Counsel, must be aware of all relevant laws and contractual obligations. Evidence Preservation and Chain of Custody: Evidence must be handled in a forensically sound manner to maintain its integrity for potential legal action. Interaction with Legal Counsel: Legal Counsel should be involved early in significant incidents to advise on obligations and manage legal privilege. 7. Plan Testing and Maintenance This IRP will be tested at least annually through methods such as tabletop exercises or simulations. The plan will be reviewed and updated based on test results, lessons learned from actual incidents, and changes in the threat landscape or business environment. The IRC is responsible for overseeing the maintenance of this IRP.