Post-incident review for the July refresh outage
Email thread Ardcarne Life Assurance: documents · exec
Declan Furlong, the CISO, read the July refresh outage review and wants evidence under DORA: detection and notification times, dated commitments for open actions, and data integrity confirmation. He is keeping the finding open.
What was said
What this says
Current to 11 Oct 26Declan Furlong, the CISO, read the July refresh outage review and wants evidence under DORA: detection and notification times, dated commitments for open actions, and data integrity confirmation. He is keeping the finding open.
Ask: Declan wants the time BB-Demo first identified the fault and the time Ardcarne was notified. He also wants a signed-off dated commitment for each undated corrective action, and confirmation that data integrity in the customer's Snowflake account was unaffected.
Customer view: he says the notification has been recorded, which reads as a mark against BB-Demo. The security finding stays open until he has these in writing.
Next: Matteo Ricci needs engineering-agreed dates and an accountable sign-off, since he told Declan he would not give undated promises.
The thread
Updated 9 Oct 26Messages
Matteo Ricci 29 Jul 2026 14:36Dear Declan, I would rather you heard this from me directly: the post-incident review for the refresh outage in July is attached. It sets out the timeline, the root cause, what was and was not affected, and when your team was told. It also lists the corrective actions, with an owner against each one. Where an action is not yet complete, the review says so plainly rather than implying it is. I know you asked for dated commitments after the outage, and I do not want to give you a date that our engineering team has not agreed. For any action in the review without a date, I will come back to you in writing once that date is confirmed. Please tell me if the format is not what you need for the register of information, and I will adjust it. Best regards, Matteo
Declan Furlong 3 Aug 2026 12:26Matteo, Thank you for the review. I have read it in full. Under DORA we need evidence rather than assurance, so I have the following questions. First, please confirm the time at which BB-Demo first identified the fault and the time at which Ardcarne was notified, so that I can record the interval. Second, for each corrective action that has no date, please provide a dated commitment, signed off by someone accountable on your side. Third, please confirm that the refresh outage did not affect the integrity of any data held in the customer's Snowflake account. I will keep the security review finding on the incident open until I have these in writing. Please also note that your notification on this occasion has been recorded. Regards, Declan Furlong, CISO