Security review: finding a slot for the working session
Email thread Ardcarne Life Assurance · sales
Declan Furlong, the CISO, accepted a working session but set three written DORA requirements first and wants dated commitments, not verbal assurances. Theo Gallagher agreed Tuesday at 14:00 and promised a dated exit plan commitment by Friday.
What was said
What this says
As at Fri 9 Oct 2026Declan Furlong, the CISO, accepted a working session but set three written DORA requirements first and wants dated commitments, not verbal assurances. Theo Gallagher agreed Tuesday at 14:00 and promised a dated exit plan commitment by Friday.
Ask: Declan wants the incident notification process, an exit plan he can attach to the register of information, and the sub-processor list with locations. He will not close a finding on a verbal assurance.
Customer view: Declan is formal and demanding but engaged, and he offered afternoon slots.
Next: Theo owes a written dated commitment on the exit plan, which exists in draft only, and the full pack by Monday ahead of the Tuesday 14:00 session.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 22 May 2026 12:14Hello Declan, Following our last call, I would like to book a working session to go through the security questionnaire with you line by line. I will open with the findings that are still outstanding and who owns each one on our side, so you can see exactly where we stand. To make the session useful, I plan to send an evidence pack beforehand: the control references we can evidence today, and a clear note on the ones where we are still gathering material. I will not describe anything as complete unless there is something dated behind it. Could you let me know which days suit you over the next couple of weeks, and whether you would like anyone from your third-party risk team to join? An hour should be enough, though I am happy to allow longer if you prefer. Thanks, Theo
Declan Furlong 28 May 2026 13:09Theo, Apologies for the delay in replying. Your note arrived in a busy week. I can offer Tuesday or Thursday of next week, in the afternoon. Before we meet, under DORA we need the following in writing: First: the incident notification process, including the time within which you notify a customer of a major incident, and who is accountable for doing so. Second: your exit plan, in a form I can attach for the register of information. Third: the list of any sub-processors that touch Ardcarne data, with their locations. Please provide a dated commitment for any item you cannot supply before the session. I will not close a finding on a verbal assurance. Regards, Declan Furlong, CISO- Theo Gallagher 28 May 2026 13:38Declan, Thank you, that is clear. Let us take Tuesday at 14:00, and I will send an invitation shortly. On your three items: First: the notification process is documented and we can evidence that. I will include the document and its control reference in the pack. Second: the exit plan exists in draft only, so I will label it as a draft and not call it final. I need to check the remaining steps with our platform team before I put a date on it. I will come back to you in writing by Friday with a dated commitment. Third: the sub-processor list is a straightforward extract and will be in the pack. I will send everything by Monday so you have it ahead of the session. Thanks, Theo