Security Incident Response Procedure

1. Purpose and Scope

This operational procedure provides a minimum response process for suspected or confirmed security incidents affecting SprintIQ, its Atlassian Forge integration, AWS storage, Bedrock processing, authentication components, customer information, or EduQuencher-managed support and administrative systems. This procedure must be adopted by the technical and management teams and tested before public release.

2. Roles and Responsibilities

Incident coordinator: EduQuencher designates an on-call technical or security lead to triage and coordinate response. support@sprintiq.eduquencher.com is the documented intake and customer contact channel.

Technical response: Engineering and AWS/Forge administrators investigate alerts, preserve evidence, contain exposure, apply fixes, and verify recovery.

Management and legal: Leadership and legal counsel determine regulatory and contract notices, approve external statements, and oversee remediation decisions.

Customer interface: Customer organizations cooperate in investigating potential compromise of their Jira environments or credentials, consistent with their respective responsibilities.

3. Incident Triggers

Investigate reports of suspected unauthorized access, tenant-data leakage, exposed secrets, insecure logs, misdirected AI prompts, unexpected external egress, data loss, malware, compromised infrastructure, confirmed vulnerabilities with exploit evidence, or malicious service disruption.

4. Intake and Initial Triage

Record detection time, source, affected systems, reporter, preliminary facts, and an incident tracking number. Use UTC timestamps for events and retain an auditable record.

Assess severity by considering customer impact, unauthorized data exposure, active exploitation, affected tenants, service availability, regulatory sensitivity, and scope of compromise.

Immediately involve technical leads for high-severity incidents and management/legal for incidents involving personal information, security reporting duties, or cross-customer impact.

5. Containment, Evidence, and Recovery

Contain malicious activity using proportionate actions such as revoking exposed tokens, rotating secrets, restricting cloud permissions, disabling affected integrations, or suspending compromised functionality.

Preserve relevant logs, security alerts, cloud audit records, and configuration snapshots with access controls and legal-hold safeguards where necessary. Maintain a timeline and track responders’ actions.

Determine root cause, fix or isolate vulnerabilities, validate tenant isolation and access controls, restore affected functions, and monitor for recurrence.

6. Notification and Escalation

Atlassian: For a qualifying Security Incident under the applicable Marketplace Partner Agreement, notify Atlassian promptly and within 48 hours of discovery or notice, unless prohibited by law, using Atlassian’s designated app security incident reporting process. Continue to provide relevant follow-up information and cooperate with reasonable requests.

Customers and regulators: Determine whether customer, individual, or regulator notification is required by law, contract, or circumstances; comply with governing deadlines and required content. Coordinate communications with counsel. Obtain Atlassian’s approval before customer breach notices that refer directly or indirectly to Atlassian, as required by the Partner Agreement.

Primary intake and coordination mailbox: support@eduquencher.com. EduQuencher must assign and document a named backup contact and ensure coverage during absences before release.

7. Post-Incident Review

For each significant incident, produce a written summary covering scope, cause, systems/data affected, timeline, containment and restoration, communications sent, lessons learned, and owner/due date for corrective actions. Review whether risk assessments, privacy notices, customer agreements, or technical controls need updating.

8. Preventive Requirements

• Remove or mask user names, email addresses, credentials, and other sensitive Jira-derived fields from app logs before production launch; inspect exception traces and telemetry.
• Verify AWS Bedrock inference-profile geography, external data egress, tenant isolation, and storage permissions.
• Confirm 3-day retention controls, deletion tests, backup policies, and auditable deletion records.
• Verify TLS, HSTS, encryption at rest, secret storage, least privilege, and AWS administrative multifactor authentication.
• Practice a tabletop incident and test the Atlassian notification escalation path at least annually and after material changes.

9. Adoption

This draft becomes an operational policy only when EduQuencher leadership assigns accountable responders, confirms technical feasibility, approves the notification workflow, and communicates it to personnel. The existence of this document alone does not establish operational readiness.