Business Continuity and Incident Management

Handling sequence, for a reported issue

Receipt; review of the steps, the page affected, and the evidence; verification by attempting to reproduce the issue; fix or decision based on the verified effect; re-check of the reported page after the fix, using the steps in the report; closure, with the reporter told the outcome for their report. A reporter may re-check the same public page after the company says a fix is in place, using only the same in-scope steps, and send the re-check result to mohammad@movahedi.ca. Detail: Responsible Disclosure and Vulnerability Disclosure Policy.

Public site incidents: disclosure route, fix, and re-check

Security issues on movahedi.ca are reported through the Responsible Disclosure page and the Security Issue Report form, which prepares an email to mohammad@movahedi.ca in the reporter's own email program. Scope is movahedi.ca only. A confirmed issue on the public site is handled through the site source in GitHub and redeployment of the corrected site, so recovery does not depend on a single live copy. After a fix, the reported page is re-checked using the steps in the report, and the reporter is told the outcome for their report. No bounty is offered unless separately approved and funded. A security contact file is published at movahedi.ca/.well-known/security.txt, with contact and policy link.

Engagement incidents: raised with the client, step agreed for that engagement

For an engagement, a confirmed problem with client material is raised with the client, and the handling step is agreed with the client for that engagement, including return or deletion where the client instructs it. For breach readiness in a client program, where that is the service engaged, the company provides breach response tools and advisory support, including the breach clock, triggers, who to notify, and the incident register a client needs to keep. Detail: Cybersecurity Self-Assessment, Respond and Recover, and Privacy Self-Assessment, Section 4.5, breach notification.

How this works in practice, in general terms

A reporter sends a report, the company reviews and attempts to reproduce it, fixes it or records a decision, re-checks the page, and tells the reporter the outcome. An engagement issue is raised with the client, the agreed handling step is completed, and the engagement record is updated. This is a generic process description. It names no reporter, no issue, and no outcome.

Related pages

• Trust Center
• Responsible Disclosure
• Vulnerability Disclosure Policy
• How work is planned, checked, and improved

Scope and limits, stated briefly

Notification timeframes and recovery objectives for a specific engagement are confirmed in writing for that engagement before work starts, under the Terms of Engagement. No timeframe or recovery figure is stated generally on this page. Contact: mohammad@movahedi.ca.