Ardcarne Life Assurance / BB-Demo – Security Review
Callcompleted
Ardcarne Life Assurance: documents · 2026-08-04 09:15
Fourth security review session. Declan Furlong kept all four findings open pending dated actions, exact notification wording, a revised exit plan draft and subcontractor notice wording. Commercial documents are on hold until the exit plan is settled.
What was said
What this says
Current to 11 Oct 26Fourth security review session. Declan Furlong kept all four findings open pending dated actions, exact notification wording, a revised exit plan draft and subcontractor notice wording. Commercial documents are on hold until the exit plan is settled.
What happened: Theo Gallagher took Declan and Aoife Kinsella through four findings: the July outage review, incident notification, the exit plan and subcontractors. All stayed open, with a written list of owners and dates promised by end of day Friday.
Customer view: Declan said regulated dated commitments are required and that the session closes the sessions, not the review. Aoife said she was agreeing nothing and that all of it is subject to Legal.
Commercial: Matteo Ricci restated 4 Sep 2026 as a target only, and quoted a draft total of £155,000 before agreeing to hold commercial documents. That figure is a draft, not executed paper.
Watch: Notification is drafted from classification, not detection, so an amendment may be needed. The exit plan is still a draft, and Matteo owes Aoife a written answer on regulator-driven changes by Thursday.
Themes
Current to 9 Oct 26Theme
Enterprise security review findings
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send the written action list with owners, dates and completion evidence by end of day Friday.
- Theo Gallagher to send the exit plan draft with derived data and access removal clauses by the following Friday.
- Matteo Ricci to give Aoife Kinsella a written answer on regulator-driven exit plan changes by Thursday.
Risks
Current to 9 Oct 26- All four findings remain open, so the 4 Sep 2026 close target may move.
- Incident notification is drafted from classification, not detection, and may need a contract amendment.
- The exit plan is still a draft and Legal has not accepted the transition period or derived data terms.
Opportunities
Current to 9 Oct 26- Closing the findings with evidence would clear the way for the order form under the Enterprise tier.
- A tabletop exit exercise during onboarding could meet the customer's request to test the exit plan.
Transcript
Theo Gallagher NoneMorning, both. Declan, Aoife, can you hear me all right?
Declan Furlong NoneGood morning, Theo. Yes, clearly.
Aoife Kinsella NoneMorning. Sorry, I was finishing something else, I'm here now. Is Matteo on?
Matteo Ricci NoneI am, buongiorno. Apologies, I was on mute. Thank you for making the time. I know this is the fourth session and everyone's diary is under pressure.- Declan Furlong NoneShall we start? As before, I'll list the open findings so we are all working from the same record. There are four. One, the post-incident review for the July outage, specifically the corrective actions and their dates. Two, the notification commitment, in writing, in a form I can use for the register of information. Three, evidence for the exit plan. Four, the list of subcontractors that touch the service. Is that your understanding, Theo?
- Theo Gallagher NoneThat matches mine, Declan. I'd add owners, so there's no ambiguity. Finding one is mine, with input from the platform team. Finding two is mine and Matteo's, because the wording ends up in the order form. Finding three is Aoife's and mine. Finding four is mine alone, and I think it's the closest to done.
- Matteo Ricci NoneIf I may, before we go in, let me restate the timeline as I understand it, so nobody is surprised. The target is to close on Friday 4 September 2026. That is a target, not a commitment, and it depends entirely on these findings being closed to your satisfaction, not on my diary.
- Aoife Kinsella NoneThank you, Matteo. I would just note, from an outsourcing perspective, that the date follows the policy steps and not the other way round.
- Matteo Ricci NoneUnderstood. That is exactly how I would like it to be.
- Declan Furlong NoneThen finding one. Theo, I have read the post-incident report. I would rather you did not summarise it. Walk me through the corrective actions and tell me which are complete.
- Theo Gallagher NoneOf course. I'll split them into done, in progress and not started, because I don't want to blur them. The done ones, we can evidence that: there is a change record and a review sign-off for each, and I'll show you in a moment. The in-progress ones each have an owner on our platform team, but I don't yet have an agreed completion date for each, and I'm not going to give you a date I haven't confirmed with the platform team lead. The not-started ones are improvements to monitoring and to how we communicate during an incident. Again, they need dates. So that's the honest position: the report is accurate, but the dating of the remaining actions is incomplete.
- Declan Furlong NoneSo some of the dates are not yet agreed.
- Theo Gallagher NoneCorrect.
- Declan Furlong NoneI appreciate the candour, but under DORA we need dated commitments, not intentions. A corrective action without a date is a finding that stays open. Please provide a dated commitment for each in-progress item and each not-started item.
- Theo Gallagher NoneHere is the dated commitment I can give today. I'll take each open action to the platform team lead tomorrow, and you will have a written list with owners and dates by end of day Friday. If a date can't be confirmed by then, the list will say so plainly, and I'll flag it to you before Friday, not after.
- Declan Furlong NoneEnd of day this Friday.
- Theo Gallagher NoneYes, this Friday. I'm aware that's only three days, so I would rather say 'not yet confirmed' than invent one.
- Declan Furlong NoneGood. And I want the evidence for the completed actions in the same pack, not as a separate message.
- Theo Gallagher NoneUnderstood. Same pack.
- Matteo Ricci NoneDeclan, may I add something on the incident itself? I would rather you heard it from me: if there is any further incident during onboarding, or before, your team hears it from us first, and from me personally on the commercial side. I said that in July and I'd say it again.
- Declan Furlong NoneI recall it. You were the first to tell me, and I recorded that. It counts in your favour, Matteo, but it does not replace a commitment. Which brings me to finding two. The notification time. Under DORA we must be able to report major incidents to the Central Bank within the regulatory windows, which means you notifying us well inside them. What is the commitment, and where is it written?
- Theo Gallagher NoneIt sits in the security schedule and in our answer to the questionnaire item on incident notification. I'm not going to quote the figure from memory, because I'd rather be exact: I'll paste the wording into the pack. What I can say is that, as drafted, it is measured from the point we classify an incident, and I know that's the part you'll push on.
- Declan Furlong NoneI will. 'From classification' is not the same as 'from detection'. Please state both, and say who classifies, by role.
- Theo Gallagher NoneNoted. I'll set out detection, classification and notification as three separate points and name the role that classifies. If the schedule only defines one of them, I'll tell you so, and then we need an amendment rather than a reading of the existing text.
- Matteo Ricci NoneAnd if an amendment is needed, let me confirm that in writing with our legal team. I don't want to say anything on this call that I can't stand behind.
- Declan Furlong NoneThat's acceptable. Please also keep that wording consistent with whatever the exit plan says about notification during a transition.
- Theo Gallagher NoneWill do. Before we move on, let me share my screen so you can see the change records for the completed actions. It's easier than me describing them. Bear with me, this takes a moment.
- Declan Furlong NoneTake your time.
- Theo Gallagher NoneRight. That is the change record for the first completed action, and the review sign-off beside it. Each completed action has the same pair. The pack will contain exactly these documents, so you can keep them with your file.
- Declan Furlong NoneI can see the dates on the records. I accept this one as evidenced. I will need the same view for the others before I close anything. Let us move on.
- Aoife Kinsella NoneFinding three. Can I first confirm which draft we are on? I have the exit plan schedule circulated last week, which Theo marked as a draft.
- Theo Gallagher NoneYes, that's the one. It is a draft, and I'd like it to stay called a draft until you and Legal are content.
- Aoife Kinsella NoneThank you. The exit plan needs to cover three things from our side: the transition period, termination assistance, and what happens to anything derived from our data after we leave. So indexes, summaries, anything the brain has built.
- Theo Gallagher NoneThat's a fair list. The structural point, which we can evidence, is that the brain runs inside your own Snowflake account. Your source data is never held by us. So exit is largely about removing our access and our application layer, and agreeing what happens to derived tables that already sit in your account. Those are yours to keep or delete.
- Aoife Kinsella NoneI would want that stated, not implied.
- Theo Gallagher NoneAgreed, it should be a clause. I'll propose wording on derived data and on removal of access, with a timescale for revoking credentials. The length of the transition period and what we do within it needs a view from beyond me, so I'll ask the platform team and our legal team rather than offer something.
- Aoife Kinsella NoneThat is the part Legal will read most carefully. Please do not tell me it is standard.
- Matteo Ricci NoneI wouldn't. What does your regulator need to see on termination assistance? If you tell me what the outsourcing register expects, I can make sure our wording answers that, rather than ours.
- Aoife Kinsella NoneThe register needs the exit strategy, whether the service is substitutable, and the transition arrangements. I'll send you the headings after the call. To be clear, I'm not agreeing anything today. All of this is subject to Legal.
- Matteo Ricci NoneOf course. That is how I'd expect it.
- Declan Furlong NoneFinding four. The list of subcontractors. I received a list. I need confirmation that it is complete, and that any change is notified to us in advance.
- Theo Gallagher NoneThe list I sent is current as of this week. Advance notification of change is in the draft, but I want to check the notice wording before I say more than that. I'll include it in the pack.
- Declan Furlong NonePlease do. And I would like any subcontractor with access to customer data flagged separately from those without.
- Theo Gallagher NoneYes. The list already has a column for it, I'll make it much clearer.
- Declan Furlong NoneOne more point for the register of information. Is the exit plan tested? A plan nobody has exercised is a document, not a control.
- Theo Gallagher NoneI agree with that, and I'm not going to overstate it. We have not run a joint exercise with you, obviously, because you aren't live. What I can offer is a tabletop walk-through of the exit steps with your team during onboarding. I'd put that in as a proposed action with an owner, rather than a promise on this call.
- Aoife Kinsella NoneA tabletop exercise would help the policy file. Please include it in the draft as an action with a timing, and I'll take a view on whether it should be a clause.
- Declan Furlong NoneReturning to finding one for a moment. Among the not-started actions you mentioned communication during an incident. What exactly will change for my team? Who calls whom, and when?
- Theo Gallagher NoneRight. As it stands, the improvement is a named contact on your side and a named contact on ours, with a route that works outside business hours, so that notification doesn't depend on whoever happens to be at their desk. The detail of the roles is one of the items I need to take to the platform team lead, so I'll put it in the Friday list with an owner and a date. I don't want to describe a rota I haven't seen agreed.
- Declan Furlong NoneThat is the kind of answer I can work with, provided it arrives in writing. I would add that I will want the named contacts in the contract schedule, not only in an email. In the July outage the information reached us through more than one route, and I could not tell which was authoritative. That is what I need to see eliminated.
- Matteo Ricci NoneThat's a fair criticism, Declan, and I won't argue with it. One authoritative route, named in the schedule. I'll make sure that is in the draft Legal sees.
- Declan Furlong NoneThank you. Now, Theo, the evidence for the in-progress actions. When they are completed, what will you send me, and how will I know it is the same item?
- Theo Gallagher NoneEach action in the Friday list will carry the same identifier as the report, so you can trace it. When it completes, you get the change record and the sign-off, the same pair you have just seen. If an action is closed in a different way, say a decision not to proceed, I'll say that explicitly and give the reason, so you can decide whether you accept it.
- Declan Furlong NoneGood. I do not accept 'not proceeding' without a reason and an alternative control.
- Theo Gallagher NoneUnderstood. No reason, no closure.
- Aoife Kinsella NoneMatteo, while we are all here. From procurement's side, I'd like to understand how any change to the exit plan after signature is handled. If our regulator asks us to amend the exit strategy, what is the mechanism?
- Matteo Ricci NoneLet me confirm that in writing, Aoife, because I'd be guessing. My understanding is that changes go through the order form and the agreement, but I want our legal team to tell you the mechanism, and whether a regulatory change is treated differently. I would rather give you a correct answer on Thursday than a quick one now.
- Aoife Kinsella NoneThursday is fine. Please make sure the answer addresses a change required by the regulator, not only one we request.
- Matteo Ricci NoneNoted, both cases.
- Declan Furlong NoneApologies, I stepped away to check one of the earlier clauses against our policy. It is fine. Let me summarise where we are, and correct me if I have anything wrong. Finding one remains open, pending dated actions and the evidence. Finding two remains open, pending the exact wording on detection, classification and notification. Finding three remains open, pending the revised exit plan draft. Finding four I am minded to close once I have the notice wording for subcontractor changes.
- Theo Gallagher NoneThat's my record too. To restate the dated items. By end of day Friday: the written list of corrective actions with owners and dates, the completion evidence, and the notification wording, all in one pack. By end of next week, the Friday after this one: the exit plan draft with proposed clauses on derived data and removal of access, and the tabletop exercise as a proposed action.
- Declan Furlong NonePlease write the day of the week in the email, not only 'next week'. I need to be able to show the Central Bank a commitment with a date on it.
- Theo Gallagher NoneFair. I'll put the day in the subject line and the body, and I'll copy Matteo so the commercial timeline sits against it.
- Aoife Kinsella NoneAnd I'll send the register headings tomorrow. Matteo, I would ask you not to send any commercial documents until the exit plan is settled.
- Matteo Ricci NoneUnderstood, I'll hold them. Forgive me, I'll only say that the total on our draft is £155,000, and that I won't raise it again until the exit plan is settled.
- Aoife Kinsella NoneNoted, and thank you for stopping there.
- Declan Furlong NoneOne last thing from me. I have been asked internally whether this session closes the review. It does not. It closes the sessions. The review closes when the findings close, with evidence, and not before.
- Matteo Ricci NoneThat is entirely clear, and I would not wish it otherwise. If the findings take longer than the target, then the target moves. I'd rather tell you that early than have you find out late.
- Declan Furlong NoneThen we understand each other. Thank you, Theo, thank you, Matteo. Aoife, anything further?
- Aoife Kinsella NoneNothing further. I'll look for the exit plan draft and the answer on regulatory change, and I'll send my headings tomorrow.
- Theo Gallagher NoneThanks, all. The pack comes by end of day Friday, with the day in the subject line. If anything slips, you hear from me before then.
- Matteo Ricci NoneGrazie, everyone. Speak soon.
- Declan Furlong NoneRegards, both. Goodbye.
Callsmade from