Controls
Logging and incident response
Incident response plan and register
In progressCriticalVerified 16 September 2026ST4S T6, AI_I2
What this control means
A written plan for security, privacy, online-safety and AI incidents, with a register recording dates, actions and who was notified, and a public status page for customer communication.
What we found
The register is live with five entries from this month's review, each with impact assessment and notification decision. The response plan is drafted and awaiting sign-off. Customers can follow incidents at status.kuraplan.com.
How we verified it
- Recorded every exposure and outage found during the September review, including ones with no evidence of access.
- Published a status page with email subscription, fed automatically by the uptime monitors.
Still to do
- Sign the incident response plan.
- Run the first tabletop exercise.
Evidence (private, draft only): kuraplan-st4s-evidence/05-monitoring/incident-register.md
Questions about this control: security@kuraplan.com