Security review: open findings and the next session
Email thread Ardcarne Life Assurance: documents · sales
Declan Furlong finds the revised exit plan clearer but wants dated commitments on data return, and will not close the notification finding without the platform team's written commitment. He prefers to review documents first.
What was said
What this says
Current to 11 Oct 26Declan Furlong finds the revised exit plan clearer but wants dated commitments on data return, and will not close the notification finding without the platform team's written commitment. He prefers to review documents first.
Customer view: The exit plan is clearer, but he has questions on data return format and who at BB-Demo owns that step. He apologised for the delay in replying to the 8 Jun 2026 note.
Ask: A written notification commitment stating the time and manner of telling Ardcarne of an incident.
Next: Theo Gallagher will extend the exit plan, chase the platform team and leave the next session date to Declan. The platform commitment was still outstanding on 11 Jun 2026.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 8 Jun 2026 10:00Dear Declan, Following our last session, here is where I think we stand on the open findings and who owns each one. Incident timeline: sent to you in writing and awaiting your comments. Owner on your side: you. Owner on ours: me. Exit plan: your comments are incorporated and a revised version is attached for your review. It is still a draft and I have marked it so. Notification commitments: this depends on our platform team. I have asked them for a dated commitment and will forward it as soon as I have it, unedited. I would like to hold a second session to go through the revised exit plan and the notification answers together. Would later this week or early next week suit you? If you would rather review the documents alone first and send questions in writing, I am happy with that too. Thanks, Theo
Declan Furlong 11 Jun 2026 10:54Theo, Apologies for the delay in replying to your note of 8 Jun 2026. I have been tied up with our own supervisory work. I have read the revised exit plan. It is clearer, but I have remaining questions on how data would be returned and in what format, and on who at BB-Demo is responsible for that step. Please provide a dated commitment for each. On notifications, I cannot close the finding until I have the platform team's commitment in writing. It would help if it states the time within which you would tell us of an incident, and how. I would prefer to review the documents first and then meet. Please send what you have, and I will propose a time once I have read it. Regards, Declan Furlong, CISO- Theo Gallagher 11 Jun 2026 11:31Declan, Thank you, that is a sensible way to proceed. I will do the following: First, add to the exit plan a section on how data is returned, in what format, and who owns each step on our side, then send the updated version marked as draft. Second, chase the platform team today for the notification commitment, and send it to you as soon as I have it. I would rather tell you it is outstanding than answer for them without asking. Third, leave the date of the next session to you once you have read both. I will write again as soon as the documents are ready. Thanks, Theo