Ardcarne Life Assurance / BG-Demo – Security Review
Callcompleted
Ardcarne Life Assurance · 16 Jun 2026 11:15
Declan Furlong, CISO, held the third of four security review sessions on incident management under DORA. Theo Gallagher left several findings open, with written commitments promised ahead of the 30 Jun 2026 signature target.
What was said
What this says
As at Fri 9 Oct 2026Declan Furlong, CISO, held the third of four security review sessions on incident management under DORA. Theo Gallagher left several findings open, with written commitments promised ahead of the 30 Jun 2026 signature target.
What happened: The 16 Jun 2026 session covered severity mapping, notification time, post-incident reviews and where responsibility sits when the incident is in Snowflake. Theo declined to quote a notification time he could not evidence.
Customer view: Declan wants dated, written commitments and will not close a finding on a verbal assurance. He also added a finding on supporting Ardcarne's own regulatory reporting, with log retention stated.
Commercial: Theo proposed a short responsibility table in the order form schedule, and Declan will take it to his legal team. Declan wants every finding closed or carrying a dated commitment by 30 Jun 2026.
Watch: Theo admitted that telling a customer about a stalled source system is a courtesy, not a documented duty. The evidence does not show whether the promised commitments were delivered.
Themes
As at Fri 9 Oct 2026Theme
DORA security review
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher to send the written notification commitment, with the clock trigger, by the end of the week after speaking to the platform team lead.
- Theo to send a revised severity mapping table, marked draft, for Declan to confirm.
- Theo to draft the responsibility table for Declan's legal team well before 30 Jun 2026.
Risks
As at Fri 9 Oct 2026- Open findings without dates could stop Declan recommending BG-Demo to the committee before the 30 Jun 2026 signature target.
- The platform team has not yet agreed a notification commitment, and the clock trigger is still undefined.
- Notifying a customer of a stalled source system is a courtesy, not a documented duty.
Opportunities
As at Fri 9 Oct 2026- A responsibility table in the order form schedule would give an Enterprise customer a binding, auditable incident position.
- Attaching incident facts to every record lets Ardcarne classify incidents under DORA from facts rather than from BG-Demo's labels.
Transcript
Theo GallagherMorning, Declan. Can you hear me all right?
Declan FurlongGood morning, Theo. Yes, clearly. Give me a moment, I have the findings tracker open on the other screen and it is being slow.- Theo GallagherNo rush. I have the same document open, so we should be looking at the same version. Mine says session three of four in the header.
- Declan FurlongYes, that matches. Incident management today, and then the final session on exit and resilience testing.
- Theo GallagherRight. Before we start, how was your week? You mentioned the board committee last time.
- Declan FurlongBusy, as ever. The committee went reasonably well. They asked, again, who would tell us first if something went wrong at a supplier, so you can see why this session matters to me.
- Theo GallagherThat is a fair question, and it is exactly what I would like to get to the bottom of today. Shall I open with the findings, the way we did before?
- Declan FurlongPlease do. I will tell you if my list differs.
- Theo GallagherSo, three open findings that belong to this session. First, the severity classification: you asked for our incident severity levels to be mapped against the classification you use for the register of information. That one is with me, and a draft mapping went to you last week. Second, the notification commitment: you asked for a dated, written commitment on how quickly we tell you about an incident that touches your data. That is also mine, but it depends on the platform team, and I will come back to that. Third, the post-incident review: you asked whether you receive the written review after an incident or only a summary. That is shared, because the wording of the contract is yours and the practice is ours.
- Declan FurlongThat is my list as well. I would add a fourth, which I raised by email: the question of where our boundary of responsibility sits when the incident is in Snowflake rather than in your software. But we can take it as part of the second.
- Theo GallagherYes, let us fold it in, because it changes the answer. Do you want to start with the mapping, since it is the one you have seen?
- Declan FurlongYes. I read your draft. Under DORA we need to be able to say, for any incident, whether it is major by our own criteria, and we need your classification to feed into that without a translation exercise every time. Your document has three severity levels. Ours has more granularity on the data and the clients affected.
- Theo GallagherUnderstood. The three levels are deliberately coarse, because they drive who gets woken up. What we can do is attach to every incident record the facts you need to classify it yourselves: which connectors were affected, whether any of your data was read or changed, how long, and whether the brain was returning stale answers. You would then classify from facts rather than from our label.
- Declan FurlongMm. That is acceptable in principle. But I want it in the mapping document, not as a description on a call. Please provide it as a table: your level, the facts supplied, and the corresponding field in our classification.
- Theo GallagherYes. I will update the draft with a column for the facts supplied and send it as a revision, clearly marked as a draft until you have confirmed it. I do not want it called final on my side until you have said it works for your register.
- Declan FurlongGood. That is the right way round. Now the notification time. Let me be direct. The question is not whether you are quick. The question is what you are prepared to put your name to.
- Theo GallagherFair. Let me say what I can evidence, and then what I cannot yet. What I can evidence today is our on-call rota and the escalation path from the support desk to the on-call engineer, and the rule that an incident with customer data in scope is escalated to the highest level automatically. I can show you that in the runbook and in the ticket tooling configuration.
- Declan FurlongAnd the time to notify the customer?
- Theo GallagherThat is the part I cannot give you on this call. The runbook has an internal target for first customer contact, but I do not own that number, and I am not going to quote it to you without asking the platform team lead whether it is the commitment they are prepared to sign up to. If I told you something now and it turned out to be an aspiration, I would have wasted your time and my credibility.
- Declan FurlongI appreciate that. It is, frankly, more useful than a confident number. But I will need it in writing, with a date. I will not close the finding on a verbal assurance.
- Theo GallagherUnderstood, and I would not ask you to. Here is what I propose. I speak to the platform team lead this afternoon. I will write to you by the end of the week with the notification commitment, and if the platform team will not commit to a number, I will tell you that plainly and tell you what they will commit to instead.
- Declan FurlongGood. Please note that for the register I also need to know whether the clock starts at detection or at confirmation. Those are not the same, and I have seen suppliers use the more flattering one.
- Theo GallagherYes. I will make that explicit. I will state the trigger, which event starts the clock, and how that event is recorded, so you can check it against the incident timeline afterwards.
- Declan FurlongNow, the boundary. This is the one I find hardest to explain to my own committee. Your brain runs inside our Snowflake account. If Snowflake has an incident, whose incident is it?
- Theo GallagherI think it helps to separate three situations. One, an incident in the Snowflake platform itself. That is between you and Snowflake under your own agreement with them, and you would hear from them directly. Two, an incident in our software running inside your account: a fault in the code, a bad release, a connector that writes something it should not. That is ours, and we notify you. Three, an incident in a source system, say your CRM or the helpdesk, which affects what the brain can load. That is neither of us, but we are often the first to notice, because the nightly refresh stops loading.
- Declan FurlongThe third is interesting. If you notice it first, do you tell us?
- Theo GallagherToday, a stalled connector shows up in the customer's admin view, and our support desk would normally raise it. Whether that is a notification you can rely on, or a courtesy, is a fair question, and I do not think the honest answer is a strong one yet. I would rather say that than tell you we have a documented duty.
- Declan FurlongThank you. That I will write down as it is. Let me ask the question the other way. Where would you want the boundary written?
- Theo GallagherIn the order form schedule, I think, as a short responsibility table with the three situations and who notifies whom. It would be binding in a way a runbook is not. I can draft the table, but the wording is for your legal team and ours, and I would not want to pre-empt the commercial side.
- Declan FurlongAgreed. Draft the table and I will take it to our legal team. They will want to see it before the signature date.
- Theo GallagherYes, and I know the target for signature is 30 Jun 2026, so I will make sure that table is with you well before that, not alongside it.
- Declan FurlongPlease. I would like every finding either closed or carrying a dated commitment by then. I cannot recommend a supplier to the committee with open items and no dates.
- Theo GallagherThat is clear, and it is the right standard. Can I take the third finding now, the post-incident review?
- Declan FurlongGo ahead.
- Theo GallagherFor any incident above the lowest level, we write a review: timeline, root cause, what was affected, and the actions with owners. What I need to check is whether the full document is shared with customers or a summary, and how long after the incident. I know the practice has been to share it, but I have only seen it done on a case by case basis. I would like to pull two or three recent examples, with identifying details removed, so you can judge the quality rather than take my word for it.
- Declan FurlongYes, please. Examples would be valuable. I would want one where the cause turned out to be on your side and not only the easy ones.
- Theo GallagherUnderstood. I will ask for a range and tell you if the set is not representative. If I can only get the tidy ones, I will say so.
- Declan FurlongThat is all I ask. Now, a related point. Under DORA we need our critical suppliers to support our own reporting to the regulator. If we have a major incident of our own that involves your service, will you give us information within a timeframe we can use?
- Theo GallagherThat is a good one, and it is a different direction of travel: you asking us rather than us telling you. I believe the answer is yes in spirit, because we hold the logs that show what the brain did and when, but I do not have a documented commitment on turnaround. I would rather add it to the list than improvise. Shall I record it as a new finding, owner me, on the same date as the notification commitment?
- Declan FurlongYes. Call it finding six. And please note that I will want the log retention period stated. If the logs are gone after a short time, the commitment is worthless.
- Theo GallagherNoted. Retention period, where the logs sit, and who in your team can read them. Since the brain lives in your account, part of the answer may be that you already hold the logs yourselves, and I would like to verify that rather than assume it.
- Declan FurlongThat would be a useful finding in itself. Right. Let me go through my numbered questions on testing, because I do not want to run out of time. First: how often do you rehearse the incident runbook, and who takes part?
- Theo GallagherI can answer part of that. There is a scheduled exercise, and the engineers on the rota take part, along with support. What I cannot tell you from memory is the frequency, and I would be guessing about whether anyone from the customer side has ever been invited. I will find out and include the last exercise record in the evidence.
- Declan FurlongSecond: when you rehearse, do you rehearse the notification step, or only the technical recovery?
- Theo GallagherGood question, and I suspect the honest answer is mostly the technical recovery. I will confirm. If the notification step is not rehearsed, I think that is a gap we should say out loud, and fix, rather than quietly hope you do not ask.
- Declan FurlongI would rather you said it. Third: is there a single named person accountable for incident communications to customers, or is it whoever is on shift?
- Theo GallagherOn shift, with an escalation to a named lead for the highest level. I would want the lead's role written into the commitment rather than a name, since names change, but I take the point that you want accountability you can point at.
- Declan FurlongA role is acceptable provided it is a role that exists. Fourth: how do you tell us? Email, phone, a status page? I need to know which channel I would be relying on at three in the morning.
- Theo GallagherEmail to the named security contacts on the account and the support ticket, with a phone call for the highest level. There is also a status page for general availability, but I would not describe that as a notification channel for you. I would suggest we agree a contact list as part of onboarding, with a deputy for you, so a single mailbox is not a single point of failure.
- Declan FurlongYes, I would want a deputy named. That is reasonable. Fifth: do you commit to telling us who told whom, and when? In the last supplier incident we had elsewhere, I was told by a journalist's question before I was told by the supplier. I do not forget that.
- Theo GallagherI understand, and I will not promise something I cannot evidence. What I can do is make the timeline in the review record the notification time and recipient, so afterwards you can see exactly what was sent and when. That makes it auditable even if it cannot make us perfect.
- Declan FurlongAuditable is the standard I need. Good. I think that covers my numbered list, unless you have something to raise.
- Theo GallagherJust one. For the final session, exit and resilience testing, I would like you to bring the questions you have about data return, because I want the exit plan to be something you have tested with us on paper and not just a clause. Is the same group attending?
- Declan FurlongYes, I will bring the same colleagues, and probably one from procurement. Let me recap what I have, so we agree it. Please correct me.
- Declan FurlongOne: a revised severity mapping as a table, marked draft, from you. Two: a written notification commitment with the clock trigger and a date, from you, by the end of this week, after you speak to the platform team lead. Three: a draft responsibility table for the three situations, in good time before 30 Jun 2026. Four: sample post-incident reviews, including one where the cause was yours. Five: the new finding on supporting our regulatory reporting, with log retention. Six: the rehearsal record and whether notification is rehearsed.
- Theo GallagherThat is my list too, line for line. Let me add the deputy contact for your side, which I will raise in the notification letter. And I will send a short note after this call with the owners and dates, so nobody has to rely on memory.
- Declan FurlongPlease do. Include the date of this session, 16 Jun 2026, so the tracker is clear on which findings arose when.
- Theo GallagherWill do. Anything else you need from me today?
- Declan FurlongNo. Thank you, Theo. This was more productive than I expected. I will wait for your note.
- Theo GallagherThanks, Declan. Speak soon. Goodbye.
Callsmade from