Security review session: finding a time
Email thread Ardcarne Life Assurance · sales
Declan Furlong accepted Thursday at 10:00 for the security review session and set written requirements under DORA: incident notification times, subcontractors and data locations, and a dated exit plan commitment with a named owner.
What was said
What this says
As at Fri 9 Oct 2026Declan Furlong accepted Thursday at 10:00 for the security review session and set written requirements under DORA: incident notification times, subcontractors and data locations, and a dated exit plan commitment with a named owner.
Ask: incident notification times in writing with the contractual commitment, the subcontractor and data location list, and a dated commitment for the final exit plan. He also wants the evidence pack before the session.
Customer view: strict and evidence-led. He says he does not close a finding without evidence attached, and a statement made on a call will not be accepted.
Next: Theo must obtain the platform team lead's confirmation on incident times and send the pack before Thursday.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 13 May 2026 14:32Hi Declan, I would like to book the working session for the security review, and I will start with where things stand, as I have them. Open items and owners: - Questionnaire evidence pack: with me. Each answer carries a control reference, and we can evidence that for the controls we have described. Where we have not got evidence ready, I will say so rather than describe the control. - Exit plan: with me, drafted together with our platform team. It is a draft and I will keep it labelled as a draft until it has been reviewed. - Incident notification times: these need confirmation from our platform team lead. I will not answer for them without asking, and I will bring you their answer in writing. Could you tell me which of these you would like to go through first, and what you need to see for your register of information? That lets me bring the right evidence on the day. For timing, I could do Tuesday or Thursday next week, in the morning, at 10:00 or 11:00. If neither suits, tell me what does and I will move things around. Thanks, Theo
Declan Furlong 13 May 2026 16:20Theo, Thank you for the list. Thursday next week at 10:00 is acceptable. I have the following requirements ahead of the session. First, under DORA we need your incident notification times stated in writing, with the contractual commitment they sit under. A statement made on a call will not be accepted. Second, for the register of information, please provide the list of subcontractors and the locations in which the data is processed, as they stand today. Third, the exit plan. I will review the draft, but please provide a dated commitment for the final version, with the name of the person responsible for it. Please send the evidence pack before Thursday so that I can read it in advance. I do not close a finding without evidence attached, and I would prefer not to spend the session reading documents for the first time. Please also tell me who at BG-Demo I should contact first if an incident occurs between now and the end of the review. Regards, Declan Furlong, CISO