Security incident: the first 48 hours
What a vetted agency does in the first 48 hours of a confirmed or suspected security incident. The window where the mark is most at risk. And most defensible.
Trigger is any of: credential exposure, unauthorized access, data exfiltration, or material loss of an audit trail. 'We think we may have' is sufficient. Wait for certainty and the window has already closed.
Agency notifies the liaison within two hours of trigger, in writing, with the facts that are confirmed and a clean separation from the facts that are not. Speculation is named as speculation.
Liaison and agency owner draft a joint written notice to affected buyers. Plain language, no qualifiers, named impact, named remediation in progress, named next update window.
Notice goes from the agency, not from Prevouched. The liaison is on the To line and is referenced as the standing accountability contact for follow-up.
Internal post-mortem timer starts now. Drafting begins before the incident closes.
Post-mortem draft completed within 48 hours. Public version redacts customer data; full version goes to Prevouched reviewer panel.
Reviewer panel scores the incident against the Security pillar of the rubric. Three outcomes: no change, observation note on file, or material rubric event. The last opens revocation review.
Disclosure to the directory: if the incident materially affects the badge's assertions, the verification page reflects status change within five business days.
- 01Trigger to liaison-notified in writing: ≤ 2 hours, even on incomplete facts.
- 02Buyer notification goes from the agency, with the liaison on the To line.
- 03Post-mortem draft exists within 48 hours; reviewer panel scores it against the rubric.
Related reading
- The first 90 days: a kickoff that does not unravel
Most offshore engagements are won or lost in the first three weeks. A repeatable kickoff that sets cadence, acceptance, and escalation before anyone writes production code.
- The reference call, run on a standardized script
The exact structure Prevouched liaisons follow on a reference call during vetting. Published so agencies can prepare and buyers can run their own.
- Buyer's guides
Longer references on scoping, contracting, and running offshore work.
- The rubric
The twelve gates and score bands every vetted agency is measured against.
- Field notes by topic
Loss patterns, buyer psychology, and agency operations, grouped.
- Vetted agency directory
See which agencies have passed the audit.