Ardcarne Life Assurance / BB-Demo – Security Review
Callcompleted
Ardcarne Life Assurance: documents · 2026-06-16 11:15
Third of four security sessions with the CISO on incident management. Three findings remain open and a fourth was added on freshness alert routing. Declan will not shorten the review to meet the commercial target of 30 Jun 2026.
What was said
What this says
Current to 11 Oct 26Third of four security sessions with the CISO on incident management. Three findings remain open and a fourth was added on freshness alert routing. Declan will not shorten the review to meet the commercial target of 30 Jun 2026.
What happened: Theo Gallagher and Declan Furlong covered incident classification, notification times, history and customer-originated incidents. Theo could evidence a stated notification time but not a measured one.
Customer view: Declan will not close any finding on a verbal answer and needs dated, written commitments for the register of information. He said it matters a great deal who tells him first.
Commercial: Declan understands the commercial target is Tuesday 30 June 2026 and said that if the evidence is not there, the date moves. Data freshness alert routing became finding four, which touches the Enterprise freshness commitment.
Watch: Written answers are due by the end of the week, and the exercise date depends on the platform team.
Themes
Current to 9 Oct 26Theme
Incident management evidence
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send written answers, the incident history document and the responsibility table draft by the end of the week.
- Theo Gallagher to confirm the platform team's exercise date and the post-incident report turnaround in writing.
- Theo Gallagher to bring the exit material in draft to the fourth session.
Risks
Current to 9 Oct 26- Three findings remain open and a fourth was added, so the review may not finish by the commercial target of 30 Jun 2026.
- Notification time is stated but not measured, and the encryption key custody answer is still awaited from the platform team.
- Who tells the customer first is a sensitive point and is only to be confirmed in writing.
Opportunities
Current to 9 Oct 26- Clear written evidence, a responsibility table and a dated exercise record could close the findings and strengthen the Enterprise case.
Transcript
Theo Gallagher NoneHello Declan, can you hear me all right?
Declan Furlong NoneI can, yes. Good morning, Theo. My video is just coming up.- Theo Gallagher NoneMorning. Take your time, we have the full slot. This is the third of the four sessions, so if it suits you I will open with where the findings stand, and then we move to incident management.
- Declan Furlong NonePlease do. That is how I prefer to begin.
- Theo Gallagher NoneRight. From sessions one and two there are three open findings. The first is the sub-processor list. That is with me, and I have sent you a draft, but I would not call it final. The second is encryption key custody. That sits with our platform team, I have asked for their written answer and I do not have it yet. The third is the audit rights wording, which is with Matteo and our contracts people. Today's block is new, so it has no findings against it yet.
- Declan Furlong NoneUnderstood. For the record, I have the same three. Please note that I will not close any of them on a verbal answer. Under DORA we need the evidence on file, because it feeds the register of information.
- Theo Gallagher NoneAgreed, and that is how I have set the tracker up. Every line has a control reference and an owner, and where we can evidence it, the evidence is attached. Where we cannot, I will say so.
- Declan Furlong NoneGood. Then to incident management. I have four questions, and I will number them. One: how do you classify an incident, and who decides the classification. Two: what are your notification times to a customer, and from which point do they run. Three: what is your incident history for the last two years. Four: how do you handle an incident that originates in the customer's own environment.
- Theo Gallagher NoneThank you, that mirrors the questionnaire nicely. Take them in order. On classification, we have a written severity scale with defined criteria, and the on-call engineer proposes the severity, but the incident lead confirms it. If there is any doubt, it goes up a level, not down.
- Declan Furlong NoneWho is the incident lead? A role, please, not a name.
- Theo Gallagher NoneA role. It is a named rota of senior engineers, one on duty at any time. I can share the rota structure. I would not share individual names in a document that goes into your register, because they change.
- Declan Furlong NoneThat is acceptable. The role and the escalation path are what I need. Go on.
- Theo Gallagher NoneQuestion two, notification times. This is the one I want to be careful about. Our contract commitments are set by the tier, and for an Enterprise order form they can be written into the order form itself. What I can evidence today is the support policy document and the runbook step that says the account owner and the customer's named security contact are told. What I cannot yet evidence is a rehearsed timing for that step, so I do not want to quote a number I cannot show you.
- Declan Furlong NoneSo there is no measured notification time.
- Theo Gallagher NoneThere is a stated one, and there is not yet a measured one that I can put in front of you. That is a fair summary. What I can offer is a dated commitment to run the notification step as an exercise and give you the record.
- Declan Furlong NonePlease provide a dated commitment, in writing, with the date the exercise will take place and the date I receive the record. A commitment without a date is not something I can show the Central Bank.
- Theo Gallagher NoneYes. I will take that as an action for me. Let me be sure I give you dates the platform team have agreed, not dates I have guessed, so I will ask them today and put both dates in the written response. Is end of the week acceptable for that?
- Declan Furlong NoneEnd of this week is acceptable.
- Theo Gallagher NoneGood. Question three, history. I have a summary of significant incidents for the period you asked about. I will share it as a document rather than read it out, so that you have the dates and the root causes in front of you. Is there anything in particular you want me to speak to?
- Declan Furlong NoneTwo things. Whether any incident affected a customer's data integrity, and whether any customer was informed by someone other than BB-Demo first.
- Theo Gallagher NoneBoth fair. On the first, I will answer in the document, incident by incident, because I would rather you read the actual wording than my summary of it. On the second, I do not have a case in the record where a customer learned first from a third party, but I will not state that as a certainty until the account teams have confirmed it. Can I come back to you on that one in writing?
- Declan Furlong NoneYou may. I will say plainly that it matters to me a great deal who tells me first. In a previous role I learned of a supplier incident from a regulator's bulletin. I do not intend to repeat that.
- Theo Gallagher NoneUnderstood. And it is a reasonable thing to ask a supplier to put in a clause, not just a policy.
- Declan Furlong NoneQuite. Which brings me to the fourth question.
- Theo Gallagher NoneYes. This one is a bit different for us, because the brain runs inside your own Snowflake account. So there are two kinds of incident. One is in BB-Demo's own tooling, the code and the pipelines we operate. The other is in your account or in one of your source systems, say a change to your CRM that breaks a connector, or a permissions change on your side.
- Declan Furlong NoneAnd the second kind, who owns it?
- Theo Gallagher NoneYou do, as the owner of the environment, but we are still obliged to tell you what we see. If our monitoring shows a connector has stopped loading, we raise it with your named contact. We do not change anything in your account without your approval. That is a design point, and I can point you to the control reference for it.
- Declan Furlong NonePlease do. And for the register, I need the boundary written down: what is BB-Demo's responsibility, what is Ardcarne's, and what is shared.
- Theo Gallagher NoneI can draft a responsibility table. I will mark it as a draft, and I will ask the platform team to review it before it goes to you, because I do not want to answer for them.
- Declan Furlong NoneThat is sensible. Now, a follow-up on classification. Does your scale distinguish an availability incident from a data freshness incident?
- Theo Gallagher NoneIt does, they are different categories in the runbook. An outage and a stale refresh are handled differently, and the record keeps them apart. Whether a given tier is compensated for each is a commercial matter, and that is in the order form, not in the security document.
- Declan Furlong NoneNoted. I will leave the commercial side to Ms Kinsella. My interest is whether I would know about a stale refresh as an operational risk, not merely as a service credit.
- Theo Gallagher NoneFair point, and I think the honest answer is that it depends on how it is raised. A stale refresh is flagged in monitoring, but whether it is notified to the security contact or to the operations contact is something we should agree. I will put it as an open question in the tracker, so we decide it explicitly.
- Declan Furlong NonePlease do. I would add it as a new finding, number four.
- Theo Gallagher NoneAdded. Finding four: routing of data freshness alerts. Owner is me, with Ardcarne's operations contact to decide the recipient.
- Declan Furlong NoneNow the post-incident report. What do you issue, and when?
- Theo Gallagher NoneFor a significant incident we issue an initial notice, then updates, then a post-incident report with timeline, root cause, impact and corrective actions. The commitment to deliver the report is in the policy. I will be straight that the exact turnaround for the final report is another item I would rather confirm than recite from memory.
- Declan Furlong NoneThen add it to the list of dated commitments. I would like the turnaround as a stated period, to sit in the contract.
- Theo Gallagher NoneYes. I will propose it to the platform team, and then it is Matteo's to carry into the contract language. Here is the dated commitment I can already give you: written answers on questions one to four, the incident history document and the responsibility table draft, all by the end of this week.
- Declan Furlong NoneAnd the exercise record?
- Theo Gallagher NoneThat depends on the platform team's date, which I will include in the same message. I would rather say that now than promise it and miss it.
- Declan Furlong NoneVery well. One more matter, on testing. Do you test your incident process, and do you share the results with customers?
- Theo Gallagher NoneWe test it, and I have seen the record of the most recent exercise. Whether we share the full results with customers is a policy question, and I do not want to say yes on behalf of the company. What I can do is ask for a summary version that I can evidence, with the findings and the actions.
- Declan Furlong NoneA summary with actions is sufficient for the register, provided it is dated and signed by a responsible person.
- Theo Gallagher NoneUnderstood, dated and signed. I will ask for exactly that.
- Declan Furlong NoneLet me read back to make sure I have the record correct. One: the incident lead is a role on a rota, and the rota structure will be shared. Two: notification times are stated but not yet measured, and a dated exercise will be committed in writing. Three: incident history arrives as a document, with the question about who told the customer first answered in writing. Four: the boundary between your incidents and ours will be a responsibility table, in draft. Five: a new finding on data freshness alert routing. Six: the post-incident report turnaround, to be stated as a period.
- Theo Gallagher NoneThat is exactly right, and better organised than my own notes. I will copy your numbering into the tracker so the two line up.
- Declan Furlong NoneThank you. I should say also that I understand the commercial target is Tuesday 30 June 2026. I will not shorten the review to meet it. If the evidence is not there, the date moves.
- Theo Gallagher NoneI would not ask you to. If it helps, the fourth session can be entirely on exit and continuity, so that we spend the time on the evidence rather than on introductions.
- Declan Furlong NoneThat would be welcome. Exit plans are where I expect the most scrutiny, both from me and from procurement.
- Theo Gallagher NoneThen I will bring the exit material to that session in draft and flag clearly what is evidenced and what is a proposal. Is there any document you want in advance?
- Declan Furlong NoneYour current data return and deletion procedure, and anything that describes how a customer's data is handed back at termination. I would prefer to read it before the session rather than during.
- Theo Gallagher NoneI will send both with the written answers, so you have them at the same time. Anything else on incident management before we finish?
- Declan Furlong NoneNot for today. I will read your response when it arrives and tell you which items I can close and which remain open.
- Theo Gallagher NoneThat is all I can ask. Thank you, Declan. I will be in touch by the end of the week.
- Declan Furlong NoneThank you, Theo. Regards. Goodbye.
Callsmade from