Security Event Reporting Procedure

ISO 27001 Control A.6.8 — Effective: March 8, 2026

1. Purpose

This procedure establishes the process for reporting information security events at H33, in accordance with ISO 27001:2022 control A.6.8 (Information security event reporting). It ensures that security events are reported promptly, assessed consistently, and escalated appropriately to minimize impact on H33's operations and customers.

All H33 personnel (employees, contractors, and third-party users) are required to report observed or suspected security events through the channels defined in this procedure.

2. Definitions

2.1 Security Event

An identified occurrence of a system, service, or network state indicating a possible breach of information security policy or failure of controls, or a previously unknown situation that may be security relevant. Security events may or may not escalate into security incidents.

2.2 Security Incident

One or more related information security events that have a significant probability of compromising business operations and threatening information security. A security incident is a confirmed event that requires a coordinated response.

2.3 Data Breach

A security incident in which sensitive, protected, or confidential data has been accessed, disclosed, or exfiltrated by an unauthorized party. Data breaches trigger specific notification obligations under applicable law (HIPAA, GDPR, state breach notification statutes).

3. Reporting Channels

Security events may be reported through any of the following channels. All channels are monitored during business hours and critical severity alerts are monitored 24/7.

4. What to Report

Personnel must report any observed or suspected security event, including but not limited to:

• Unauthorized access attempts: Suspicious login activity, privilege escalation, access from unknown locations or devices
• Suspicious system behavior: Unexpected processes, unexplained performance degradation, unusual network traffic, unexpected configuration changes
• Lost or stolen devices: Laptops, phones, USB drives, or any device with access to H33 systems or data
• Phishing attempts: Suspicious emails, messages, or links targeting H33 personnel or impersonating H33
• Policy violations: Observed violations of H33 security policies (e.g., sharing credentials, disabling security controls)
• Malware indicators: Suspicious files, unexpected pop-ups, anti-virus alerts, ransomware indicators
• Third-party compromises: Notifications from vendors about breaches that may affect H33 data or services
• Physical security events: Tailgating, unauthorized visitors, suspicious packages
• Cryptographic anomalies: Unexpected FHE decryption failures, signature verification failures, key material anomalies

5. Reporting Procedure

When a security event is observed or suspected, the reporter should follow these steps:

1. Notify immediately: Contact the Security Officer via Slack (#security-incidents) or email (security@h33.ai). For P1 Critical events, also call the Security Officer directly.
2. Document the event: Record the following information as completely as possible:
   • Who: Who observed the event? Who may be involved?
   • What: What happened? What systems, data, or services are affected?
   • When: When was the event first observed? Is it ongoing?
   • Where: What systems, networks, or physical locations are involved?
   • How: How was the event detected? What indicators were observed?
3. Preserve evidence: Do not delete logs, emails, files, or other potential evidence. Take screenshots if possible. Note any error messages or system states.
4. Do not attempt remediation: Unless explicitly authorized by the Security Officer, do not attempt to fix, investigate, or remediate the issue. Unauthorized actions may destroy evidence or worsen the situation.
5. Maintain confidentiality: Do not discuss the event with unauthorized individuals. Do not post details on public channels, social media, or external platforms.

6. Severity Levels

The Security Officer will classify each reported event according to the following severity levels:

7. Escalation Path

Security events follow the escalation path below. Each level is notified when the event meets the criteria for that level, or when the lower level cannot adequately resolve the event.

8. Post-Incident Review

Following the resolution of any P1 or P2 security incident (and optionally for P3 events), the Security Officer will conduct a post-incident review within 5 business days. The review covers:

• Root Cause Analysis: What was the root cause? Was it a technical failure, human error, or process gap?
• Timeline: Detailed timeline of detection, escalation, containment, and resolution
• Impact Assessment: What data, systems, or customers were affected? What was the business impact?
• Corrective Actions: What changes to controls, configurations, policies, or training are needed to prevent recurrence?
• Lessons Learned: What worked well in the response? What should be improved?
• Policy Updates: Are any security policies or procedures inadequate and requiring revision?

Post-incident reports are retained for a minimum of 3 years and are available to auditors upon request.

9. Non-Retaliation

H33 maintains a strict non-retaliation policy for security event reporting:

• Good-faith reporting of security events is protected. No employee or contractor will face disciplinary action, termination, or other retaliation for reporting a suspected security event in good faith.
• Anonymous reporting is available via the anonymous reporting channel. Anonymous reports receive the same priority and investigation as attributed reports.
• Retaliation against a reporter is itself a policy violation subject to disciplinary action, up to and including termination.

10. Training and Awareness

All H33 personnel receive training on this procedure during onboarding and annually thereafter. Training covers:

• How to recognize security events
• Reporting channels and procedures
• Examples of reportable events specific to H33 (cryptographic operations, cloud infrastructure, authentication systems)
• Non-retaliation protections
• Evidence preservation best practices

11. Review

This procedure is reviewed annually by the CEO/CISO, or more frequently following a significant security incident, organizational change, or regulatory update.

Next scheduled review: March 2027