Security review: follow-up session and open findings
Email thread Ardcarne Life Assurance · sales
After the session, Theo Gallagher set out three open findings with himself as owner. Declan Furlong confirmed the summary, kept the first two findings open until dated records and a reviewed exit plan arrive, and added backup locations.
What was said
What this says
As at Fri 9 Oct 2026After the session, Theo Gallagher set out three open findings with himself as owner. Declan Furlong confirmed the summary, kept the first two findings open until dated records and a reviewed exit plan arrive, and added backup locations.
Ask: Declan wants dated incident records, an exit plan delivered as a reviewed document with a date, and sub-processor locations including backups, not only primary processing.
Customer view: He called Theo's summary accurate, which is a constructive sign, but the bar stays evidence on file, not description.
Next: A thirty-minute follow-up is set for Thursday at 10:00. Theo owns all three items.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 8 Jun 2026 17:01Declan, Thank you for your time today. For the record, here is where we left the open findings and their owners. First: incident notification evidence. You asked for the dated records behind the process. Owner: me. I will send the extract this week. Second: the exit plan. You asked for the draft to be turned into a version you can attach to your register of information. Owner: me, with input from our platform team. I will confirm in writing the date it will be ready, and I will not call it final until it has been reviewed. Third: sub-processor locations. You wanted the data residency position stated explicitly for Ardcarne. Owner: me. I would like to book a short follow-up so we can close what can be closed. Do you have time on Thursday or Friday this week? Thirty minutes would be plenty if the evidence has gone across by then. Thanks, Theo
Declan Furlong 8 Jun 2026 18:10Theo, Your summary matches my own notes, which I appreciate. Thursday at 10:00 works for me. Please note that the first finding stays open until I have the dated records in hand, and the second stays open until the exit plan arrives as a reviewed document with a date on it. Under DORA we need that evidence on file, not a description of it. One addition for the third item: please state which locations hold backups, not only the primary processing location. Regards, Declan Furlong, CISO