Ardcarne Life Assurance / BG-Demo – Security Review
Callcompleted
Ardcarne Life Assurance · 4 Aug 2026 09:15
Fourth and last security review session after the July outage. The CISO has four findings open. BG-Demo admitted the change was its own and the notification was late. Recovery evidence stays open; price is parked.
What was said
What this says
As at Fri 9 Oct 2026Fourth and last security review session after the July outage. The CISO has four findings open. BG-Demo admitted the change was its own and the notification was late. Recovery evidence stays open; price is parked.
What happened: Theo Gallagher ran the fourth and last security review session on 4 Aug 2026 with Declan Furlong and Aoife Kinsella. Four findings were open: root cause, notification, recovery evidence and the exit plan.
Customer view: Declan said he learned of the July outage from his own analyst, not from BG-Demo. Matteo Ricci apologised, and Theo said the change was BG-Demo's own and the testing did not cover the setting.
Commercial: Matteo mentioned £155k as the total deal value in the working draft and parked it. Aoife will not discuss price until the exit plan is settled.
Watch: Recovery evidence stays open until a witnessed restore exercise runs. Declan closes findings only with evidence, and 4 Sep 2026 is a target that depends on the exit plan.
Themes
As at Fri 9 Oct 2026Theme
Post-incident security review
Importance
complaint
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher to send the written notification procedure with the window by the Friday of that week.
- Theo Gallagher to send the dated post-incident report, recovery objectives for challenge and a revised exit annex.
- Matteo Ricci to send a follow-up note with a two-section table of owners and dates, including proposed wording on the exercise.
Risks
As at Fri 9 Oct 2026- Finding three on recovery evidence stays open until a witnessed restore exercise is scheduled and run.
- The notification window must sit inside the customer's regulatory clock, and no figure has yet been agreed with the platform team.
- The exit plan annex is still a draft and is the item that moved the close date before.
Opportunities
As at Fri 9 Oct 2026- Declan Furlong said the handling in this review has been better than in July, which gives room to rebuild trust.
- Making the witnessed restore exercise a contractual condition could be written into the order form through Legal.
Transcript
Matteo RicciGood morning, Declan, good morning, Aoife. Can you both hear me all right?
Declan FurlongGood morning. Yes, clearly.
Aoife KinsellaMorning, Matteo. Yes, fine here. Sorry, one second, I have the wrong draft open. Right. Go on.
Theo GallagherMorning all. Theo here. I can see everyone, so I think we are complete.- Matteo RicciWonderful. Before we start, how was the week for you? I hear Dublin has been rather grey.
- Aoife KinsellaGrey and wet, as usual. The quarter-end reporting has everyone a bit short on patience, but we are fine.
- Declan FurlongSame. Shall we begin? This is the fourth session, and it is the one I have been waiting for, the post-incident review.
- Matteo RicciOf course. Let me restate where we are, so we all share the same timeline. This is the last of the four review sessions. The order form is in negotiation, and we are working towards signature by 4 Sep 2026. Everything we discuss today feeds into that. And Declan, I would rather you heard it from me directly: nothing about July will be softened today.
- Declan FurlongThank you, Matteo. I will take you at your word, but I will also want it in writing. Let me list the open findings as I have them. One, the root cause of the July outage, stated in a document I can put before the Central Bank. Two, the notification timeline: when your side knew, when we were told, and by whom. Three, evidence that the recovery arrangements work, not that they exist. Four, the exit plan, which is Aoife's. Is that your list too, Theo?
- Theo GallagherYes, that matches my tracker. Four open findings. Finding one and two have my name against them, finding three sits with the platform team and me jointly, and finding four is shared with Aoife and our contracts people. I would suggest we take them in that order, and I will mirror your numbering so the minutes line up.
- Declan FurlongPlease do.
- Theo GallagherFinding one, root cause. I have the post-incident report here and I can share it. The short version is that a change to the scheduled refresh jobs, inside the Snowflake environment that runs the brain, interacted badly with a configuration setting, and the query layer stopped answering. It was a change we made, not an upstream failure, and I want to be plain about that.
- Declan FurlongMm. Stop there, please. When you say a change you made, was that a change under your change management process, with an approval?
- Theo GallagherIt was. There was an approval record. What the review found is that the testing step did not cover the configuration setting in question. So the control existed and the control was followed, but the control was not sufficient. That is the finding, and I would rather say it that way than claim the process failed outright.
- Declan FurlongThat is a more honest answer than I usually receive. I will need the report to say exactly that, with the change record referenced.
- Theo GallagherWe can evidence that. The change record reference is in the appendix. I will send you the report as a document, not a slide, so you can attach it to your register.
- Declan FurlongFor the register of information, yes. Good.
- Aoife KinsellaCan I ask something, Theo, from an outsourcing perspective? Was the outage inside what the service description said you could do to a customer environment? Because I read the draft and I could not tell.
- Theo GallagherFair question. In the brain model, our jobs run inside the customer's own account, so yes, it is within the permissions we hold. But that is precisely why the control matters. I would say the permission was appropriate and the testing was not. I will write the distinction into the report, so it is not left to interpretation.
- Aoife KinsellaThank you. Please do.
- Declan FurlongFinding two, then. Notification. I will be direct. In July, I learned of the outage from one of my own analysts who noticed the broker view was empty. I did not learn it from you. I have not forgotten that.
- Matteo RicciNo, and you should not forget it, Declan. At that point you were a prospect in a pilot, and no formal notification path had been agreed with you. That is an explanation, not an excuse. Our own team did not reach out to you quickly enough, and I should have called you myself the moment I knew. I did not, and I am sorry for it.
- Declan FurlongNoted. And what is different now?
- Theo GallagherThree things, and I will give you the dated version of each. First, a named security contact on your side receives a direct notification from our incident lead, by email and by phone, as soon as an incident is classified. Second, an initial notice goes out within the window your regulator expects of you, and I will put that window in the contract schedule in your terms, not mine. Third, a written follow-up with root cause comes after the incident is closed.
- Declan FurlongUnder DORA we need the initial notice early enough for my own reporting obligations to the Central Bank. Your window has to be shorter than mine, otherwise it is useless to me.
- Theo GallagherUnderstood. Then I will not propose a window today. I will take your regulatory clock as the constraint and come back with a figure that sits comfortably inside it, agreed with the platform team. I am not going to quote you something I have not checked with them.
- Matteo RicciAnd to be clear, I will not commit a date on behalf of engineering. Theo will bring us what they have agreed.
- Declan FurlongThen please provide a dated commitment. When will I have the notification window in writing?
- Theo GallagherI spoke to the platform lead yesterday and asked for exactly that. What I can say today is that the written notification procedure, with the window, will be with you by the end of this week. Here is the dated commitment: Friday. If the platform team cannot meet it, I will tell you on Thursday, not on Friday afternoon.
- Declan FurlongFriday, then. I will note it. And I will note who said it.
- Theo GallagherPlease do.
- Declan FurlongThird finding. Evidence that recovery works. In the earlier sessions you described the arrangements. I have read the description. I want evidence of a test.
- Theo GallagherRight. Here is where I have to be careful, because I will not overstate this. We have a restore procedure and we have run it in our own test environment. What we have not yet done is run it against a customer-shaped environment with a customer's reviewer watching. I do not want to hand you a test result that is really a rehearsal.
- Declan FurlongSo the honest position is that finding three stays open.
- Theo GallagherYes. It stays open. What I can offer is a witnessed restore exercise, scheduled with your team, with the results documented against the control reference. I would propose we agree the scope and a date for that in writing, once the platform team confirms availability.
- Declan FurlongI would want my own people to observe. And I would want the recovery objectives written down before the exercise, not after, so that we are measuring against something.
- Theo GallagherThat is sensible. Objectives first, then the exercise, then the report. I will draft the objectives and send them to you for challenge, so you are not marking my homework.
- Declan FurlongI am quite happy to mark it.
- Matteo RicciI am sure you are. Declan, would it help if I added the exercise as a condition in the order form, so that it is contractual and not a favour?
- Aoife KinsellaMatteo, I will stop you there, politely. I cannot agree terms on a call. If Declan wants it as a condition, it needs to come through the draft, and it goes to Legal before anything else.
- Matteo RicciOf course, Aoife. Let me confirm that in writing instead. I will send a note after this call setting out the proposed wording, and you can take it through your process.
- Aoife KinsellaThank you. That is the right route.
- Declan FurlongFinding four is yours, Aoife. I will leave you to lead.
- Aoife KinsellaThank you. First, so we are all looking at the same thing: we are discussing the exit plan annex that Theo circulated last week, the draft marked version two in the folder, and not the earlier one. Can everyone confirm?
- Theo GallagherConfirmed. And to be clear for the record, it is a draft. I would not call it final.
- Aoife KinsellaGood. From an outsourcing perspective, the exit plan needs to cover three things. How we get our data out, in what format and how quickly. What termination assistance you provide and for how long. And what happens to the derived material, the pages and summaries the brain has built, because that is the part I could not find in the draft.
- Theo GallagherTaking those in turn. Data out first. Because the brain is built inside your own Snowflake account, your source data and the tables we create stay with you. There is no extraction step, and that is the strongest part of the exit story. What we remove on exit is our access and our jobs.
- Aoife KinsellaAnd the derived material?
- Theo GallagherThat is the gap, you are right. The draft says the tables remain, but it does not say in plain terms that the derived content remains yours. I will add a clause reference for that, and a short description of the export format. I will raise the wording with our contracts team rather than invent it here.
- Aoife KinsellaSubject to Legal, that would resolve it. The termination assistance, then?
- Theo GallagherThe draft describes a transition period in which we keep supporting read access while your team repoints. What is missing is the length and the named responsibilities. Again, I do not want to improvise a duration. I will take that to the right people and bring you a proposal in writing.
- Aoife KinsellaThen I should say, this is the item that moved the close date last time, and I would rather not see it move again. Nothing proceeds to price discussion until the exit plan is settled. I appreciate that is awkward for Matteo.
- Matteo RicciNot awkward at all, Aoife. It is the right order. For completeness, the total deal value in the working draft is £155,000, and I mention it only so everyone knows what is on the table, not to discuss it. It stays parked until you are content with the exit plan.
- Aoife KinsellaNoted, and parked. Thank you.
- Declan FurlongMay I return to the incident? There is a fifth matter that is not on my list, and I would like it recorded. What does your side do differently in practice, day to day, so that a change like July's does not reach production again?
- Theo GallagherGood, because that is the real question. The corrective actions in the report are these. A broader pre-release test set that includes configuration settings of the kind that failed. A second reviewer on any change to scheduled jobs that touches a customer environment. And a staged rollout, so a change reaches a small number of environments before it reaches all of them.
- Declan FurlongWhich of those are done and which are intended?
- Theo GallagherLet me be exact. The second reviewer is in place now, and I can evidence it from the change records. The broader test set is in progress. The staged rollout is designed but not yet running. I will mark each one in the report as done, in progress or planned, with owners.
- Declan FurlongThat is how it should be written. And for the ones in progress, dates.
- Theo GallagherDates, yes. Not ones I make up in this call. I will ask the platform team for the completion dates and put them in the report. Where they cannot give a date, the report will say so.
- Declan FurlongI would prefer an honest gap to a comfortable date.
- Matteo RicciWhich is also what we would prefer to give you. Declan, what does your regulator need to see from us, in the end? I want to make sure we are not producing a good document that answers the wrong question.
- Declan FurlongFair. The Central Bank will want to see that I assessed the supplier, that I identified the weaknesses, that I obtained dated commitments for them, and that I have a plan if the supplier fails me. The report, the notification procedure, the exercise objectives and the exit plan are the four pieces. If I can show those, with dates, the file is defensible.
- Matteo RicciThen let me read it back, so we are sure. Four pieces, each with an owner and a date. Would you like me to summarise them in the follow-up note?
- Declan FurlongPlease. A table, with the owner and the date against each line.
- Aoife KinsellaAnd please keep the contractual items separate from the security items. They go to different reviewers on our side.
- Matteo RicciUnderstood. Two sections.
- Declan FurlongOne more question, since Theo is here. Subcontractors. Does anything in the brain's operation depend on a third party that I would need to list?
- Theo GallagherWithin what I know, the dependencies are the systems you choose to connect, and Snowflake as the platform it runs on, both of which are yours. If there is any further dependency on our side, I will not guess. I will check with the platform team and confirm in the same document.
- Declan FurlongPlease confirm it even if the answer is none. A stated none is evidence. A silence is not.
- Theo GallagherAgreed. I will state it either way.
- Aoife KinsellaFrom my side, then. Once I have Theo's revised annex, with the derived content clause and the termination assistance proposal, I will review it against our outsourcing policy. Realistically that needs a couple of weeks, with Legal. I will not skip a step to hit the date.
- Matteo RicciNor would I ask you to. If the review takes the time it takes, then we discuss the date honestly, rather than squeezing the process.
- Aoife KinsellaThank you, Matteo. I appreciate that.
- Declan FurlongI will say one thing for the minutes. The incident was a poor start. The way it has been handled in this review has been better than the way it was handled in July. That is not nothing, but it is also not closure. I close findings with evidence.
- Theo GallagherThat is the right standard, and we would rather meet it than be congratulated. Let me summarise my actions so you can correct me. One, post-incident report as a document, with the change record reference and the status of each corrective action, owners and dates. Two, notification procedure with the window, by Friday. Three, recovery objectives for the witnessed exercise, drafted for your challenge. Four, revised exit annex with the derived content clause and the termination assistance proposal. Five, a stated answer on third-party dependencies.
- Declan FurlongThat matches my notes. Please add that the report is dated and versioned. I do not want to wonder later which one I am holding.
- Theo GallagherDated and versioned. Understood.
- Matteo RicciAnd mine. The follow-up note today with the two sections, and the proposed wording on the exercise as a contractual condition, for Aoife's process. I will also keep the schedule to 4 Sep 2026 visible, but only as a target that depends on the exit plan being settled first.
- Aoife KinsellaThat is acceptable, as a target. I will treat it as such.
- Declan FurlongThen I think we have what we need from today. I will review each item as it arrives, and I will tell you plainly which findings I can close and which I cannot.
- Matteo RicciThat is all we ask. Thank you both, truly. Grazie, Declan, Aoife. Speak soon.
- Aoife KinsellaThank you. Goodbye.
- Declan FurlongGoodbye.
- Theo GallagherThanks, everyone. Talk Friday.
Callsmade from