Ardcarne Life Assurance / B-Brain – Security Review
Callcompleted
Ardcarne Life Assurance: documents · 2026-06-16 11:15
Third of four security sessions with the CISO on incident management. Three findings remain open and a fourth was added on freshness alert routing. Declan will not shorten the review to meet the commercial target of 30 Jun 2026.
What was said
What this says
Current to 11 Oct 26Third of four security sessions with the CISO on incident management. Three findings remain open and a fourth was added on freshness alert routing. Declan will not shorten the review to meet the commercial target of 30 Jun 2026.
What happened: Theo Gallagher and Declan Furlong covered incident classification, notification times, history and customer-originated incidents. Theo could evidence a stated notification time but not a measured one.
Customer view: Declan will not close any finding on a verbal answer and needs dated, written commitments for the register of information. He said it matters a great deal who tells him first.
Commercial: Declan understands the commercial target is Tuesday 30 June 2026 and said that if the evidence is not there, the date moves. Data freshness alert routing became finding four, which touches the Enterprise freshness commitment.
Watch: Written answers are due by the end of the week, and the exercise date depends on the platform team.
Themes
Current to 9 Oct 26Who was there
B-Brain
Them
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send written answers, the incident history document and the responsibility table draft by the end of the week.
- Theo Gallagher to confirm the platform team's exercise date and the post-incident report turnaround in writing.
- Theo Gallagher to bring the exit material in draft to the fourth session.
Risks
Current to 9 Oct 26- Three findings remain open and a fourth was added, so the review may not finish by the commercial target of 30 Jun 2026.
- Notification time is stated but not measured, and the encryption key custody answer is still awaited from the platform team.
- Who tells the customer first is a sensitive point and is only to be confirmed in writing.
Opportunities
Current to 9 Oct 26- Clear written evidence, a responsibility table and a dated exercise record could close the findings and strengthen the Enterprise case.