| Level | Definition | Response time | Example |
|---|---|---|---|
| P0 — Critical | Confirmed PHI breach or exfiltration | 1 hour | Unauthorized bucket access to phi-core |
| P1 — High | Suspected breach; system compromised | 4 hours | Unusual IAM grant; SA key leaked |
| P2 — Medium | Security anomaly; no confirmed breach | 24 hours | Failed auth spikes; new geo access |
| P3 — Low | Policy violation; no data impact | 72 hours | Workflow using wrong SA |
| Role | Name | Contact |
|---|---|---|
| Incident Commander | Shahin Mohammadi | mohammadi@cytognosis.org |
| Privacy Officer | [TBD] | [TBD] |
| Technical Lead | [TBD] | engineering@cytognosis.org |
| Legal | [TBD — engage for P0 only] | [TBD] |
gs://cytognosis-phi-core/
``bashStep 1: Identify the accessor
gcloud logging read \
'resource.type="gcs_bucket" AND resource.labels.bucket_name="cytognosis-phi-core" AND protoPayload.methodName=~"storage.objects"' \
--project=cytognosis-infrastructure \
--format="json" \
--limit=50 | jq '.[] | {time: .timestamp, who: .protoPayload.authenticationInfo.principalEmail, what: .protoPayload.methodName, object: .protoPayload.resourceName}'
HHS notification requirement: HIPAA Breach Notification Rule requires notice to
HHS and affected individuals within 60 days of discovering a breach affecting ePHI.
Scenario 2: Service Account Key or OIDC Token Compromise (P1)
Trigger: Unexpected API calls using website-deployer SA; unknown GitHub Actions run
`bash
Step 1: Immediately disable the SA
gcloud iam service-accounts disable \
website-deployer@cytognosis-infrastructure.iam.gserviceaccount.com
Step 2: Check recent activity
gcloud logging read \
'protoPayload.authenticationInfo.serviceAccountKeyName=~"website-deployer"' \
--project=cytognosis-infrastructure --limit=100
Step 3: Re-enable after investigation, rotate OIDC pool if needed
gcloud iam service-accounts enable \
website-deployer@cytognosis-infrastructure.iam.gserviceaccount.com
Step 4: If OIDC pool compromised, delete and recreate provider:
gcloud iam workload-identity-pools providers delete github-provider \
--workload-identity-pool=github-pool --location=global
`
Scenario 3: Compute Node Compromise (P1)
Trigger: cytohost shows unexpected outbound connections; unusual process activity
`bash
Step 1: Isolate the node (remove external IP / deny all egress)
gcloud compute instances delete-access-config cytohost \
--access-config-name="External NAT" --zone=us-central1-b
Step 2: Create a forensic disk snapshot
gcloud compute disks snapshot cytohost \
--zone=us-central1-b --snapshot-names="forensic-$(date +%Y%m%d%H%M)"
Step 3: Stop the instance
gcloud compute instances stop cytohost --zone=us-central1-b
Step 4: Provision a clean replacement from the container framework
(follow runner-setup.md)
`
Scenario 4: Accidental Public Bucket Exposure (P2)
Trigger: Public access alert; data appears in public bucket scans
`bash
Step 1: Re-enable uniform bucket-level access (removes all ACLs)
gcloud storage buckets update gs:// --uniform-bucket-level-access
Step 2: Revoke any allUsers / allAuthenticatedUsers bindings
gcloud storage buckets remove-iam-policy-binding gs:// \
--member=allUsers --role=roles/storage.objectViewer
Step 3: Audit what was exposed (which objects, for how long)
Check audit logs for public reads in the exposure window
Step 4: If PHI was exposed → escalate to P0 procedures
`
Scenario 5: CI/CD Supply Chain Attack (P2)
Trigger: Unexpected dependency in published package; unauthorized push to registries
`bash
Step 1: Identify what was pushed
gcloud artifacts docker images list \
us-central1-docker.pkg.dev/cytognosis-phi-prod/cytognosis-website-v2 \
--include-tags --sort-by="~UPDATE_TIME" | head -10
Step 2: Delete malicious artifact
gcloud artifacts docker images delete \
us-central1-docker.pkg.dev/.../website: --quiet
Step 3: Rotate all CI secrets
GitHub: org settings → Secrets → rotate any compromised values
Secret Manager: create new secret versions, update Cloud Run env vars
Step 4: Review and tighten OIDC condition
gcloud iam workload-identity-pools providers update-oidc github-provider \
--workload-identity-pool=github-pool --location=global \
--attribute-condition='attribute.repository_owner=="cytognosis"'
`
Post-Incident Requirements
1. Document: Create
compliance/incident-log/YYYY-MM-DD-