Security review: finding a time
Email thread Ardcarne Life Assurance: documents · sales
Theo Gallagher and CISO Declan Furlong agree a working session. Declan sets written-only conditions: timestamped July outage timeline under DORA, a readable exit plan, and a list of platform-team dependencies.
What was said
What this says
Current to 11 Oct 26Theo Gallagher and CISO Declan Furlong agree a working session. Declan sets written-only conditions: timestamped July outage timeline under DORA, a readable exit plan, and a list of platform-team dependencies.
Ask: Declan wants incident notification times from BB-Demo's records with timestamps, and an exit plan he can read. Nothing he places in the register of information may rest on a verbal assurance.
Customer view: Cooperative but strict; he holds the security sign-off. The July outage is under direct scrutiny.
Next: Theo will send the timeline, the exit plan marked as a draft, and the platform dependency list before the Wednesday session at 14:00.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 28 May 2026 09:51Dear Declan, Niamh asked me to contact you directly about the security review. I took it over from a colleague earlier this year, so I have read the earlier correspondence in full, including the notes from the period of the July outage. I would like to propose a working session and to agree the agenda in advance. As I see it, the open items are: First, incident history and notification times, including what we told you and when. Second, the exit plan, so that you can see how Ardcarne would leave and retrieve its data. Third, the information you need from us for your register of information. For each item I will bring the control reference and the evidence where we have it. If an answer depends on our platform team, I will say so and come back with a dated commitment. Would early next week suit? I could do Tuesday or Wednesday afternoon, and I am happy to work around you. Thanks, Theo
Declan Furlong 29 May 2026 15:24Theo, Thank you for the structure. Wednesday afternoon is workable for me. Some points so that the session is useful: First, under DORA we need the incident notification times shown from your records, not summarised. Please provide the timeline for the July outage, with timestamps. Second, the exit plan must be a document I can read, not a description of one. Third, anything you tell me that I will place in the register of information must be in writing. I do not close a finding on a verbal assurance. Please also confirm which of the items depend on your platform team, so that I know what to expect and when. Regards, Declan Furlong, CISO- Theo Gallagher 29 May 2026 17:50Declan, Understood, and thank you for being so specific. Let us take Wednesday afternoon at 14:00. I will send a calendar invitation this evening. Before then I will send you, in writing: First, the incident timeline with timestamps, as it stands in our records. Second, the exit plan document in its current version. It is a draft and I will mark it as one, so that you know exactly what you are reading. Third, a short list showing which answers depend on the platform team, with the date by which I will have each of them. If anything I send does not match what you need for the register, tell me and I will correct it before the session rather than during it. Thanks, Theo