# WiseBoard Incident Response Runbook

**Version 1.0 — April 18, 2026**
**Owner:** Chaz Landry (Operator)
**On-call rotation:** Single-operator. Backup contact: `info@mywiseboardclassroom.com`.

## Purpose

Define the steps, timelines, and responsibilities for detecting, responding to, and notifying customers about security incidents — particularly those affecting Covered Information under signed DPAs.

## Incident severity

| Severity | Definition | Response time |
|---|---|---|
| **SEV-1** | Confirmed unauthorized access to Covered Information; live data breach; ransomware; full Service outage > 1 h. | Within 1 h of detection |
| **SEV-2** | Suspected unauthorized access; partial outage; subprocessor incident with potential WiseBoard data exposure. | Within 4 h |
| **SEV-3** | Vulnerability disclosed (no exploit confirmed); degraded performance; account-lockout incidents > 10 in 1 h. | Within 1 business day |
| **SEV-4** | Single-user issues; minor functional bugs without security impact. | Standard support |

## Response steps

### 1. Detect & triage (T+0 — T+1 h for SEV-1)
- Source: monitoring alert, customer report, security@ email, or manual discovery.
- Acknowledge in writing to the reporter within 2 business hours.
- Open an incident record (date/time, source, affected systems, suspected scope).

### 2. Contain (T+1 h — T+4 h)
- **If credential compromise:** rotate the affected credentials, revoke sessions, force password reset, rotate Stripe / Resend / OpenAI / Replit API keys as applicable.
- **If application vulnerability:** roll back the offending deploy or hot-patch + redeploy. Use the Replit Deployments rollback to the last known-good release.
- **If subprocessor incident:** verify upstream containment, rotate keys / OAuth tokens issued to that subprocessor, and pause the integration if Covered Information could be in flight.
- Preserve logs (application logs, observability events, DB audit trail) by snapshotting to a separate secure store before containment alters state.

### 3. Eradicate & recover (T+4 h — T+24 h)
- Identify root cause.
- Apply fix (patch, config change, dependency upgrade).
- Verify Service health via the status-page health checks.
- Restore from encrypted backups if data integrity was affected (RPO 24 h, RTO 8 h).

### 4. Notify (within 72 h of confirmation for breaches affecting Covered Information)
- Notify each affected LEA via the Trust Center contact on file (and a fallback email to the LEA's authorized representative as recorded in the executed DPA).
- Notification contents (per FERPA / NY 2-d / TX SB 820 / SOPPA / GDPR Art. 33 norms):
  1. Nature of the incident (what happened).
  2. Categories and approximate number of records affected.
  3. Likely consequences.
  4. Mitigation taken and planned.
  5. Point of contact at WiseBoard.
  6. Recommended action by the LEA (if any).
- File any state-required regulator notifications within statutory deadlines (e.g. NY Ed. Law 2-d notice to the Chief Privacy Officer of the State Education Department).
- For SEV-1, post a public incident on the Status Page (`/status`).

### 5. Post-incident review (within 14 days)
- Written post-mortem covering: timeline, root cause, customer impact, what worked, what didn't, action items with owners and dates.
- Share post-mortem summary with affected LEAs on request.
- File action items in the engineering backlog and track to completion.

## Specific playbooks

### Stripe webhook tampering or signing-key compromise
1. Rotate the Stripe webhook signing secret in the Stripe dashboard.
2. Update `STRIPE_WEBHOOK_SECRET` in Replit Secrets and redeploy the API server.
3. Reconcile subscription state by replaying recent events from Stripe's event log.

### OpenAI API key leak
1. Revoke the leaked key in the OpenAI dashboard.
2. Rotate `OPENAI_API_KEY` in Replit Secrets, redeploy.
3. Audit billing for unrecognized usage; file with OpenAI support if abuse confirmed.

### Database access compromise
1. Rotate the PostgreSQL credentials via Replit's managed DB console.
2. Audit the audit log for the time window of suspected access.
3. If Covered Information was accessed, follow the breach-notification flow above.

### Lost laptop / endpoint compromise (operator)
1. Rotate the operator's Replit, GitHub, Stripe, OpenAI, and Resend credentials.
2. Force sign-out of all sessions on those accounts.
3. Trigger remote wipe via OS provider; assume the worst until verified.

## Communication templates

Customer-facing breach notification draft is in `docs/compliance/breach-notification-template.md`.

## Contacts

- **Operator on-call:** Chaz Landry — `info@mywiseboardclassroom.com`
- **Privacy / Trust escalation:** `info@mywiseboardclassroom.com`
- **General support:** `info@mywiseboardclassroom.com`
- **Cyber-liability carrier:** see `docs/legal/insurance/` for current policy + claims hotline.