# WYG Incident Response Procedure — Pilot

**Updated:** August 23, 2026
**Security channel:** wygplaybookapp@gmail.com
**Emergency contacts:** [INCIDENT COMMANDER] / [TECHNICAL LEAD] / [PRIVACY LEAD] / [COUNSEL] / [INSURER]

This procedure covers security, privacy, availability, integrity, backup, and abuse incidents. The separate School Breach Notification Procedure controls student-data notice details and the signed agreement controls required deadlines.

## Severity

- **Critical:** confirmed unauthorized student-data access, destructive data loss, widespread account compromise, inability to restore, or sustained service failure during active team use.
- **High:** suspected unauthorized access, repeated operations-access denial, material 5xx outage, failed backup evidence, exploitable high-impact vulnerability, or integrity risk to tests/scores.
- **Medium:** contained abuse, limited feature outage, isolated dependency finding, or suspicious activity without confirmed student impact.
- **Low:** non-sensitive defect or control improvement with no current confidentiality, integrity, or availability impact.

## Response sequence

1. **Identify and record.** Create a restricted incident record with time, reporter, request IDs, systems, symptoms, and initial severity. Do not copy unnecessary student content.
2. **Assign command.** Name an incident commander and technical/privacy leads. Establish a restricted communication channel and decision log.
3. **Contain safely.** Revoke affected sessions or secrets, restrict access, disable the smallest affected feature, block abusive traffic, or roll back the release. Preserve service when doing so does not increase harm.
4. **Preserve evidence.** Save relevant logs, deployment version, audit events, provider notices, times, and hashes. Keep chain-of-custody notes and access restrictions.
5. **Assess impact.** Determine affected programs, people, records, actions, time range, confidentiality/integrity/availability impact, and whether school or legal notice is required.
6. **Notify.** Contact the school without unreasonable delay under the signed agreement and applicable law. Provide verified facts, protective actions, contact information, and updates; do not speculate.
7. **Eradicate and recover.** Remove the cause, patch and test, restore only with two-person approval, validate health and trusted score history, and monitor for recurrence.
8. **Close and learn.** Document root cause, timeline, impact, notifications, recovery evidence, and corrective owners/dates. Review within five business days of stabilization.

## Communication rules

Only the incident commander or designated school/privacy contact communicates externally. WYG will not publicly identify a school or student without authorization or legal obligation. Legal counsel reviews regulated notice, law-enforcement contact, and public statements.

## Tabletop and evidence

Before student launch, run a tabletop covering compromised coach access plus a failed database write. Verify account/session revocation, alert routing, school contact, D1 recovery decision, private-file assessment, immutable score evidence, and executive decision logging. Repeat annually and after a material incident or architecture change.