Incident response plan · Version 1.0 · 31 August 2026

Act immediately.
Report within 24 hours.

This plan activates for any suspected or confirmed unauthorised access, disclosure, alteration, loss or misuse of Amazon Information, SP-API credentials, LWA credentials or EmenCore systems that process them.

Assigned roles

The Incident Commander / Security Lead declares severity, coordinates the response and owns Amazon notification. The Technical Response Lead contains the event, preserves evidence, investigates and validates recovery. The Privacy and Legal Lead assesses data and regulatory duties. The Communications Lead maintains the timeline and coordinates accurate notices. A named person is assigned to every role when the plan activates; one person may cover multiple roles, but no responsibility is omitted.

First 24 hours

Record discovery time and affected systems; preserve logs and evidence without copying tokens into tickets or chat; disable affected sessions and connections; rotate credentials where necessary; assess whether Amazon Information is involved; and notify Amazon at security@amazon.com within 24 hours of discovery. The first notice states discovery time, known scope, containment, contact owner and the next-update plan. Unknown facts are marked as under investigation; notification is not delayed for a complete investigation.

Investigation and recovery

Maintain a timestamped decision log, identify root cause and affected identities or data, remove malicious access, patch the cause, revoke affected authorisations, rotate credentials and restore only from verified sources. Before normal operation resumes, validate MFA, password controls, token encryption, audit logging and least privilege.

Closure and review

Document final scope, impact, notifications, root cause and corrective actions. Complete a lessons-learned review with owners and due dates. Review this plan at least every six months and after every material incident, Amazon requirement change or significant architecture change. Last review: 31 August 2026. Next scheduled review: no later than 28 February 2027.

Contact