Incident plan

Who

Matt Isaman leads every incident. Dan James leads when Matt cannot be reached within the hour, and the founder not leading reviews every notice before it goes. Anyone can report a suspected incident to security@athleteorchard.com, which both founders read every day.

What counts as an incident

• Someone reached a club’s or a school’s data who should not have: another club, a person without the role, anyone outside.
• Data left our systems where it should not have: an export, an email or a link that reached the wrong person.
• A secret was exposed: a database, payment, sign-in or email key, or the morning run’s secret.
• A service we use tells us of a breach on their side (the list in the Data Security and Privacy Plan). Their telling us is our discovery.
• Anyone reports one to us, a parent, a coach, a district or a researcher.
• An alert from our own error log about sign-in, the activity log, money or a club’s data that we cannot explain.

The steps, in order

1. Record it (at once; whoever finds it, then the incident lead)

• Write down the time it was found, who found it, and exactly what was seen, before changing anything.
• Tell the other founder. This is the discovery: the moment anyone here first knows of it or suspects it, and the clock for telling a club or school starts now.

2. Contain it (within hours; the incident lead)

• Stop the exposure first: end the person’s access and sessions, turn the feature off, take down a public link, or roll the site back to the last good release.
• Replace any secret that may have been seen, and check nothing used the old one since.
• Copy the evidence on the first day: the hosting logs are short-lived, so what they show is saved before it ages out.

3. Find out what happened (within 72 hours; the incident lead, with the other founder)

• Read the activity log (the changes and actions it records, kept), the log of who opened which child’s record, and our own error log (counts by kind, kept 90 days), with whatever the services’ own logs still hold.
• Establish which clubs or schools, which kinds of record, how many people, and whether a child’s record was among them, from the database itself and those logs.
• Decide whether it is a breach to report: when in doubt, it is.
• Cooperate with the club or school, the state and law enforcement, and keep the evidence they need intact.

4. Tell the people it concerns (as soon as we know enough to say what happened, and never later than 7 calendar days after discovery (sooner where an agreement or the law says so); the incident lead writes it; the other founder reviews it, and if they cannot within a day of the deadline it goes anyway)

• In writing, to each affected club, and to each affected school or district at the contact and in the way its agreement names: a brief description of what happened; the dates it happened and was discovered; the kinds of personal information involved; an estimate of how many records; what we are doing to investigate, or plan to; and a person families can contact for help.
• Do not hold the notice for the whole investigation: send what is known, then updates until it is closed, and a final report.
• For a New York school, the district reports to the state; we work with the district and the state, and pay for, or promptly reimburse the district for, the full cost of the notifications a breach attributed to us requires.
• Where guardians need to know directly, work with the club or school so they are told.

5. Put it right (as soon as it is contained; the incident lead)

• Put back what was changed or deleted from the daily backups (7 days of them), restored to a copy first so nothing else is overwritten, and check the result with the club or school.
• Fix the cause, with a test that fails without the fix, before the feature is turned back on.

6. Learn from it (within two weeks; both founders)

• Write down what happened, what worked, what did not, and what changes; then change it, and update this plan.
• Keep a written report of the incident with this plan, where the founders and a district asking can read it (a practice run’s goes on the list below).

Practice

Twice a year, and before the first school signs, the founders walk through a made-up incident as if it were real, and write down what changes. The scenario for the first: A coach emails to say a parent from another club can see their team’s roster. Walk the six steps as if it were real: who is told, what is turned off, which logs are read, what the clubs are told and when, and what changes after.

No practice run has been held yet. The first is held before a school signs.

Related

The promises this plan keeps are on the security page and in the Data Security and Privacy Plan.