Safety & Compliance

DEOS Incident Response Policy And Process

Company: I REVLAB, INC.
Program Owner: DEOS Security and Engineering, with Management, Operations, and Legal oversight
Document Version: 2.0
Last Updated: November 4, 2026
Review Cycle: At least annually and following material incidents or changes

DEOS maintains a coordinated incident response process to identify, assess, contain, investigate, and recover from security incidents affecting its systems, dealership information, and connected services. The process assigns decision-making authority, protects evidence, coordinates customer and regulatory communications, and tracks corrective actions. It covers conventional cyber threats as well as incidents involving tenant separation, AI agents, integrations, and customer communications. Protecting information and limiting ongoing harm guide the response from initial report through recovery and review.

Purpose And Scope

This policy establishes the DEOS Incident Response Plan's governing requirements and public-facing process. Detailed response playbooks, contacts, operational targets, and technical procedures are maintained internally. The objectives are to reduce harm, restore authorized service, meet applicable legal and contractual duties, maintain accurate records, and improve controls using incident findings.

The approach draws on NIST SP 800-61 Rev. 3 and supports the DEOS information security program and SOC 2 Type 1 readiness activities. Alignment with a framework does not guarantee prevention or establish that every incident creates the same reporting obligation.

Table Of Contents

01. Governance And Response Authority

DEOS maintains an Incident Response Team (IRT) with assigned primary and alternate responsibilities. Roles may be held by designated individuals or approved external specialists; a role title does not imply a separate department or a continuously staffed function.

Role Responsibility And Authority
Incident Coordinator Directs response, assigns ownership, maintains the incident record, sets update intervals, and coordinates escalation and recovery decisions.
Security And Engineering Responders Investigate, preserve evidence, contain threats, remediate weaknesses, and validate technical recovery within delegated authority.
Operations And Service Owners Assess service and dealership impact, coordinate continuity, manage dependencies, and support controlled restoration.
Legal And Privacy Assess notification duties, contractual obligations, evidence preservation, individual rights, and appropriate involvement of outside counsel or authorities.
Communications And Customer Support Deliver approved information through verified channels and coordinate customer actions without disclosing other dealerships' information.
Executive Leadership Provides resources and decisions for material incidents, including significant business risk and external specialist engagement.

The Incident Coordinator may authorize containment within delegated authority, including disabling compromised accounts, pausing agents, or isolating affected integrations. Responders may take immediate protective action within approved incident procedures when delay would increase harm. They record the action and escalate promptly. Material recovery decisions involve the affected service owner and relevant Security or Engineering authority; Legal coordinates notification determinations.

Management maintains escalation contacts, alternates, and external assistance arrangements in restricted internal records. Executive approval or commercial concerns must not delay a mandatory notice beyond its applicable deadline.

02. Incident Definitions And Scope

A security event is an observable occurrence that may require review. A security incident is an occurrence that compromises, or presents a credible threat to, the confidentiality, integrity, or availability of DEOS systems or protected information, or violates applicable security requirements. A reportable breach or notification event is a legal determination under the applicable law or agreement; it is not synonymous with every alert or incident.

Examples include account takeover, phishing, malware, ransomware, unauthorized access or exports, data corruption, lost devices, inadvertent disclosures, cross-dealership access, compromised integrations, and malicious interference with AI tools or communications. A serious service disruption may require coordinated incident and continuity response even where unauthorized data access has not been established.

The policy covers DEOS corporate and cloud environments, applications, APIs, DDU data stores, communications, AI models and agents, support processes, and relevant provider dependencies. It applies to employees, contractors, and authorized providers according to their access and responsibilities.

03. Preparation And Readiness

DEOS maintains response procedures, system and data-flow information, access and service ownership records, relevant logging, escalation contacts, and recovery arrangements. Playbooks address significant scenarios, including compromised identities, ransomware, dealership-data exposure, integration compromise, and unsafe AI behavior.

Preparation includes workforce awareness, responder instruction, controlled access to investigative tools, evidence storage, backup and restoration arrangements, and provider coordination. An alternate communication route is maintained for circumstances in which the normal collaboration or identity environment may be compromised.

Monitoring and escalation arrangements are designed for the services and risks involved. Automated alerting does not by itself establish continuous human review or a guaranteed response time. Detailed operational targets and contractual commitments are maintained in the appropriate internal records and agreements.

04. Detection, Reporting, And Initial Triage

Personnel must promptly report suspected incidents through the designated internal security or incident channel. Customers and external parties may report suspected account compromise or service-related security concerns to support@deos1.com; security, privacy, and diligence inquiries may be sent to legal@deos1.com. A person does not need to establish that a breach occurred before reporting.

Initial reports should identify the affected service or dealership, time observed, nature of the concern, and a safe contact method. Passwords, private keys, authentication codes, or unnecessary consumer information must not be sent in ordinary email. DEOS coordinates secure evidence transfer where needed.

The receiving team records the report, checks urgency, preserves relevant information, and routes it to the responsible responder. Triage considers ongoing harm, affected identities and tenants, data sensitivity, service impact, and the reliability of the available evidence. Reports initially assessed as false positives or ordinary service issues retain an appropriate record of the assessment.

05. Severity And Escalation

Severity is assigned using actual and reasonably foreseeable impact, not merely the number of affected users. Classifications may change as evidence develops.

Severity Illustrative Conditions Required Response
Critical Active widespread compromise, credible cross-dealership exposure, ransomware affecting critical systems, or uncontrolled agent actions causing material harm. Immediate escalation to the Incident Coordinator and designated leadership; urgent containment and Legal involvement.
High Confirmed compromise of protected information or privileged access, or material disruption with significant ongoing risk. Urgent coordinated investigation, containment, impact assessment, and notification review.
Moderate A localized incident with limited apparent impact that requires investigation and corrective action. Assigned owner, proportionate containment, documented investigation, and escalation if scope or risk increases.
Low A contained minor incident with low apparent impact and no indication of broader compromise. Documented assessment, necessary remediation, and review for recurring patterns.

Severity does not determine whether a statutory or contractual notice is required. A seemingly small incident may still trigger notification duties. Internal response targets are set according to urgency and applicable commitments; this table does not create a separate customer SLA.

06. Investigation And Evidence Preservation

Responders establish a timeline and assess entry points, affected accounts, systems, information, dealerships, providers, and downstream actions. They distinguish confirmed facts from assumptions and identify gaps that limit conclusions. Absence of an alert is not proof that information was unaffected.

Evidence may include relevant logs, identity events, configuration history, deployment records, messages, tool calls, snapshots, and forensic artifacts. Collection is proportionate and restricted to authorized purposes. Responders record collection times, sources, handlers, and material transfers; integrity checks and chain-of-custody records are used where appropriate.

Evidence is protected from unauthorized alteration, access, or deletion and retained under applicable schedules and legal holds. Investigation must not unnecessarily reproduce consumer records or expose one dealership's information to another. Legal involvement does not automatically make every operational record privileged.

Preservation is coordinated with urgent containment. Where collecting evidence first would materially increase harm, responders may prioritize protection and document the reason and any resulting investigative limitation.

07. Containment And Impact Control

Containment limits ongoing exposure and unauthorized activity. Measures may include revoking sessions and tokens, disabling accounts, rotating compromised secrets, isolating workloads, restricting network access, pausing exports, disabling integrations, or suspending affected AI tools and communication queues.

The response considers tenant boundaries, shared dependencies, and the potential impact of containment on unaffected dealerships. Broader restrictions may be necessary when the scope is uncertain, but access or service is not restored solely to meet a commercial deadline.

Containment decisions record the expected benefit, affected services, decision-maker, and follow-up conditions. Necessary emergency changes follow the DEOS IT Change Management System's expedited process. A queue pause or account disablement is a protective measure, not a conclusion that an incident has been fully resolved.

08. Eradication And Remediation

Responders identify and address the cause and persistence mechanisms supported by the investigation. Actions may include removing malicious artifacts, closing unauthorized access paths, correcting permissions or configurations, patching vulnerabilities, rebuilding affected workloads, and rotating exposed credentials or keys.

Remediation assesses related accounts, systems, integration scopes, data stores, and deployment artifacts to reduce recurrence. Where a root cause remains uncertain, the record identifies that uncertainty, compensating controls, and the additional investigation required.

Provider-dependent issues are escalated through approved channels. DEOS assesses the risk of continued connection and may restrict or suspend the affected integration while remediation proceeds. A provider's statement that its own incident is closed does not alone establish that DEOS exposure or customer impact has been resolved.

09. Recovery And Return To Service

Recovery uses validated restoration, rebuild, or forward-recovery procedures appropriate to the affected system. Responders assess backup integrity, residual access, system configuration, relevant security controls, data consistency, and authorized integration behavior before restoring normal operation.

The Incident Coordinator coordinates a documented return-to-service decision with the responsible service and technical owners. Restoration may be staged, with heightened monitoring and defined conditions for pausing or reversing recovery. Recovery objectives follow the applicable service tier and agreement rather than an unsupported universal recovery promise.

Before resuming automation, teams verify queued actions, retry behavior, recipient eligibility, consent and suppression state, and duplicate-action controls. Messages already delivered, records already changed, and information already disclosed require separate impact handling; reverting software cannot undo those effects.

Recovery records distinguish restoration of core service from completion of the investigation and corrective actions. Continued monitoring and assigned follow-up may remain necessary after service resumes.

10. Dealership Data, AI, And Communication Incidents

Suspected cross-dealership access receives priority assessment. Responders examine tenant authorization, group permissions, retrieval indexes, caches, logs, exports, support access, and other relevant paths. The investigation identifies affected dealership contexts without revealing another customer's private records in updates or evidence packages.

For AI-related incidents, responders assess model and prompt versions, retrieval context, inference routing, tool permissions, agent actions, and relevant safeguards. They may restrict autonomous execution, disable a tool, revert a configuration, or require human approval while determining whether a failure is isolated or systemic. Prompt injection and model-generated instructions are treated as untrusted inputs, not authority to bypass access controls.

Potential exposure of private information to an unauthorized model, provider, or training process requires tracing the data flow and assessing retention and onward-use risks. Training exclusions and processing restrictions remain applicable during an incident. Emergency response does not permit pooling dealership records or sending private content into an unapproved external AI tool.

Communication incidents include unauthorized outreach, failed suppression, incorrect recipients, misleading AI representations, and unauthorized likeness use. Response may require pausing campaigns, reconciling preferences, preserving consent records, and coordinating corrective communications. Legal and the affected customer assess appropriate notices and next steps without assuming that every communication error is a legally reportable data breach.

11. Customer, Provider, And Regulatory Notifications

Legal and the Incident Coordinator maintain a notification assessment that identifies the relevant jurisdictions, contractual roles, affected information, discovery or determination dates, notice triggers, recipients, deadlines, and responsible owners. The assessment is updated as facts develop and records the basis for both notification and non-notification decisions.

The FTC Safeguards Rule includes incident-response and notification provisions for covered financial institutions. DEOS evaluates its own obligations and supports affected dealerships' duties according to its role. A covered dealership's regulatory reporting obligation is not automatically an identical obligation for every service provider.

Applicable state requirements, including the Florida Information Protection Act, may impose distinct duties on covered entities and third-party agents. Other jurisdictions, information categories, or agreements may require different or earlier action. DEOS does not apply a single notification period to every incident.

Affected customers receive notice as required by the applicable agreement and law, with available facts, known impact, containment measures, and recommended actions. Initial notice is not delayed merely because the investigation or root-cause analysis is incomplete. Updates distinguish established facts from evolving assessments and correct material inaccuracies.

Regulator, individual, law-enforcement, insurer, and provider communications are coordinated by the authorized functions. Customer coordination does not displace a direct legal duty or create a right to veto a required notice. Any legally permitted delay is evaluated and documented; it is not presumed from an open investigation.

Notifications and evidence packages use verified recipients and appropriate secure channels. Public status information avoids private customer details and unnecessary disclosures about exploitable weaknesses.

12. Documentation And Incident Closure

Each incident has a record proportionate to its significance, including the report, severity changes, timeline, affected systems and data, investigative findings, evidence references, containment and recovery decisions, notifications, and corrective actions. Records identify accountable owners and material uncertainties.

Access is restricted, retention follows the applicable schedule, and legal holds take precedence over routine deletion. Copies and working files are controlled so incident response does not create unnecessary new repositories of dealership information.

The Incident Coordinator closes the active incident when required response and recovery activities are complete or transitioned to accountable follow-up, notification decisions are recorded, and residual risks are assigned and escalated appropriately. Closure does not erase unresolved findings or mean that all recurrence risk has been eliminated.

13. Post-Incident Review And Corrective Action

Every confirmed incident receives a review proportionate to its severity. Material, recurring, or significant AI and dealership-data incidents receive a structured review involving the relevant owners. Reviews consider what happened, contributing causes, detection and escalation performance, containment, recovery, communications, and control gaps.

Corrective actions have an owner, priority, target date, and evidence needed for acceptance. Management reviews overdue or material actions through the DEOS Trust Management System. An action is not complete merely because a ticket is closed or a policy is rewritten; the relevant improvement must be implemented and assessed.

Lessons inform architecture, monitoring, permissions, provider oversight, training, playbooks, and recovery planning. Reviews encourage accurate reporting and learning while preserving accountability for deliberate misconduct or unauthorized activity.

DEOS reviews this policy and its internal response procedures at least annually and after material incidents, exercises, system changes, or changes in applicable requirements. Contact and escalation information is updated when responsibilities change.

Incident-response exercises are conducted at least annually and after significant changes where warranted. Exercises test practical decisions, escalation, evidence handling, customer coordination, and notification assessment. They complement the quarterly continuity and recovery exercises described in the DEOS Security And Technology Policies; the two activities have related but distinct objectives.

This policy operates alongside the DEOS Trust Management System, Security And Technology Policies, IT Change Management System, Security Awareness Training And Education, AI Governance Policy, Dealership Data Safeguards, TCPA Policy, Privacy Policy, and applicable customer agreements. Restricted internal playbooks supply implementation details without publishing sensitive procedures or credentials.

15. Information Security Policies Notice

This document summarizes the DEOS security policy framework and communicates requirements for the personnel and providers within its scope. It does not, by publication alone, amend a customer agreement, create a separate service-level commitment, or change contractual remedies. Security or processing obligations expressly incorporated into an Agreement remain enforceable according to that Agreement.

DEOS reviews and updates its policies to reflect operational requirements, risks, technology, and law. Material changes follow applicable governance, contractual notice, and acceptance requirements. A policy revision does not retroactively authorize prohibited processing or reduce a nonwaivable right or duty.

Security controls are designed to manage risk and protect information; they do not guarantee that every incident or vulnerability will be prevented. This notice does not exclude responsibility for Company's own breach, negligence, unlawful conduct, or other liability contrary to law or the applicable Agreement. Customers and users remain responsible for the security duties assigned to them under their agreements.

Security, privacy, governance, and diligence inquiries: legal@deos1.com
Operational support and suspected account compromise: support@deos1.com

I REVLAB, INC.
4910 Communications Ave, Suite 120
Boca Raton, FL 33431