Incident Response Procedures

Document ID: PLCY-INC-001
Effective Date: December 22, 2025
Last Review: December 22, 2025
Owner: Hop And Haul Team

CONFIDENTIAL

This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.

1. Purpose

This document defines the incident response procedures for Hop And Haul, covering operational incidents, safety events, security breaches, and regulatory issues to ensure timely detection, response, and resolution.

2. Incident Categories

2.1 Operational Incidents

Incident Type	Severity	Response Time
Route deviation (minor)	Low	30 minutes
Route deviation (major)	Medium	15 minutes
Unplanned stop (short)	Low	30 minutes
Unplanned stop (extended)	Medium	15 minutes
Ride cancellation mid-trip	Medium	Immediate
Driver unresponsive	High	Immediate
Vehicle breakdown during ride	High	Immediate

2.2 Safety Incidents

Incident Type	Severity	Response Time
HOS violation during ride	High	Immediate
Vehicle safety alert	High	Immediate
Accident/collision	Critical	Immediate
Driver incapacitation	Critical	Immediate
Passenger injury	Critical	Immediate
Aggressive driving report	Medium	15 minutes

2.3 Security Incidents

Incident Type	Severity	Response Time
Unauthorized access attempt	High	15 minutes
Data breach (suspected)	Critical	Immediate
Data breach (confirmed)	Critical	Immediate
Account compromise	High	15 minutes
System intrusion	Critical	Immediate
Insider threat	Critical	Immediate
API abuse	Medium	1 hour

2.4 Compliance Incidents

Incident Type	Severity	Response Time
DOT inquiry received	High	Same business day
Insurance coverage gap discovered	High	4 hours
Audit finding (critical)	High	24 hours
Audit finding (non-critical)	Medium	5 business days
Privacy complaint	Medium	24 hours
Data retention violation	Medium	24 hours

3. Incident Response Team

3.1 Team Structure

Role	Responsibility	Contact Method
Incident Commander	Overall response coordination	PagerDuty escalation, incident-commander@fleetlink.example.com
Operations Lead	Operational incident handling	PagerDuty escalation, ops-lead@fleetlink.example.com
Safety Lead	Safety incident handling	PagerDuty escalation, safety@fleetlink.example.com
Security Lead	Security incident handling	PagerDuty escalation, security@fleetlink.example.com
Legal/Compliance	Regulatory incident handling	Direct phone, legal@fleetlink.example.com
Communications	Internal/external communications	Direct phone, comms@fleetlink.example.com
Technical Lead	System investigation/remediation	PagerDuty escalation, tech-lead@fleetlink.example.com

3.2 Escalation Path

Level 1: On-call Operations
    ↓ (if unresolved in 15 min or High severity)
Level 2: Department Lead
    ↓ (if unresolved in 30 min or Critical severity)
Level 3: Incident Commander
    ↓ (if Critical or regulatory implications)
Level 4: Executive Leadership

4. Detection & Alerting

4.1 Automated Detection

Monitoring Source	Detected Incidents
GPS tracking	Route deviations, unplanned stops
ELD integration	HOS violations
Samsara alerts	Vehicle safety issues
Application monitoring	System errors, API issues
Security monitoring	Access anomalies, intrusion attempts
Log analysis	Pattern-based threat detection

4.2 Manual Reporting

Reporter	Reporting Method
Drivers	In-app incident report
Operations	Dashboard alert creation
External parties	Support contact
Regulators	Formal notification

4.3 Alert Routing

Severity	Notification Method
Critical	Phone call + SMS + Email + App alert
High	SMS + Email + App alert
Medium	Email + App alert
Low	App alert + Dashboard

5. Response Procedures

5.1 Immediate Response (All Incidents)

Step	Action	Timeline
1	Acknowledge incident	Within alert SLA
2	Assess severity and impact	5 minutes
3	Escalate if necessary	Per escalation path
4	Begin containment	Immediate
5	Document initial findings	Concurrent

5.2 Route Deviation Response

Step	Action	Owner
1	System detects deviation	Automated
2	Alert sent to Operations	Automated
3	Contact driver for status	Operations
4	Assess reason (traffic, emergency, etc.)	Operations
5	If unexplained, escalate to Safety	Operations
6	Document incident and resolution	Operations

5.3 HOS Violation Response

Step	Action	Owner
1	ELD integration detects violation	Automated
2	Immediate alert to Operations + Safety	Automated
3	Contact driver with stop directive	Safety
4	Arrange alternative transport for passenger	Operations
5	Document violation per DOT requirements	Safety
6	Post-incident review	Safety

5.4 Insurance Coverage Gap Response

Step	Action	Owner
1	Gap detected during validation	Automated
2	Affected matches blocked	Automated
3	Operations notified	Automated
4	Insurance team contacted	Operations
5	Coverage restored and verified	Insurance
6	Matching re-enabled	Operations

5.5 Unauthorized Access Response

Step	Action	Owner
1	Anomaly detected in access logs	Automated
2	Security team alerted	Automated
3	Suspicious session terminated	Security
4	Account suspended pending review	Security
5	Forensic analysis initiated	Security
6	User contacted (if legitimate)	Security
7	Access restored or permanently revoked	Security

5.6 Data Breach Response

Step	Action	Owner	Timeline
1	Breach detected or reported	Various	T+0
2	Incident Commander activated	Security	T+15 min
3	Containment measures implemented	Technical	T+30 min
4	Scope and impact assessed	Security	T+2 hours
5	Legal/Compliance notified	Commander	T+2 hours
6	Notification requirements determined	Legal	T+4 hours
7	Affected parties notified	Communications	Per law
8	Regulatory notifications filed	Legal	Per law
9	Root cause analysis	Technical	T+48 hours
10	Remediation implemented	Technical	As identified
11	Post-incident review	Commander	T+7 days

6. Containment Strategies

6.1 Operational Containment

Incident	Containment Action
Route deviation	Contact driver, monitor closely
HOS violation	Direct driver to stop, arrange replacement
Vehicle issue	Direct to safe location, dispatch assistance
Driver unresponsive	Escalate to Safety, contact emergency services

6.2 Security Containment

Incident	Containment Action
Account compromise	Suspend account, revoke sessions
API abuse	Rate limit or block source
Data exposure	Revoke access tokens, rotate keys
System intrusion	Isolate affected systems

7. Documentation Requirements

7.1 Incident Record Fields

Field	Required
Incident ID	Yes
Detection timestamp	Yes
Detection method	Yes
Category and type	Yes
Severity level	Yes
Affected parties	Yes
Description	Yes
Timeline of events	Yes
Containment actions	Yes
Resolution actions	Yes
Root cause	Yes
Lessons learned	Yes
Follow-up actions	Yes

7.2 Retention

See PLCY-RET-001 Records Retention Policy for authoritative retention schedule.

Summary of applicable retention periods:

Record Type	Retention
Incident records	36 months
Supporting evidence	36 months
Communications	36 months
Post-incident reports	36 months

Refer to PLCY-RET-001 for legal hold procedures and destruction requirements.

8. Post-Incident Activities

8.1 Root Cause Analysis

Step	Action	Timeline
1	Collect all evidence	Within 24 hours
2	Interview involved parties	Within 48 hours
3	Analyze timeline and contributing factors	Within 72 hours
4	Identify root cause(s)	Within 5 days
5	Document findings	Within 7 days

8.2 Remediation Planning

Priority	Remediation Timeline
Critical gaps	Immediate (before closure)
High-risk improvements	30 days
Medium improvements	90 days
Low-priority enhancements	Next planning cycle

8.3 Lessons Learned

After each significant incident:

Conduct post-mortem meeting
Document what worked well
Document what needs improvement
Update procedures as needed
Share learnings with relevant teams

9. Regulatory Reporting

9.1 DOT/FMCSA Notifications

Event	Reporting Requirement
Accident with injury	Report per FMCSR regulations
HOS violation pattern	Internal documentation, inspection readiness
Vehicle safety issue	Documentation per FMCSR

9.2 Data Breach Notifications

Jurisdiction	Notification Timeline
California (CCPA)	"Expedient" - typically 72 hours
Other states	Varies - typically 30-60 days
Federal	Per applicable regulation

10. Testing & Training

10.1 Tabletop Exercises

Exercise Type	Frequency
Operational incident	Quarterly
Security breach	Semi-annually
Regulatory scenario	Annually

10.2 Training Requirements

Role	Training Frequency
Incident Response Team	Quarterly
Operations staff	Semi-annually
All employees	Annually (awareness)

11. Document Control

Version	Date	Author	Changes
1.0	[DATE]	[NAME]	Initial release

Incident Response Procedures ​

1. Purpose ​

2. Incident Categories ​

2.1 Operational Incidents ​

2.2 Safety Incidents ​

2.3 Security Incidents ​

2.4 Compliance Incidents ​

3. Incident Response Team ​

3.1 Team Structure ​

3.2 Escalation Path ​

4. Detection & Alerting ​

4.1 Automated Detection ​

4.2 Manual Reporting ​

4.3 Alert Routing ​

5. Response Procedures ​

5.1 Immediate Response (All Incidents) ​

5.2 Route Deviation Response ​

5.3 HOS Violation Response ​

5.4 Insurance Coverage Gap Response ​

5.5 Unauthorized Access Response ​

5.6 Data Breach Response ​

6. Containment Strategies ​

6.1 Operational Containment ​

6.2 Security Containment ​

7. Documentation Requirements ​

7.1 Incident Record Fields ​

7.2 Retention ​

8. Post-Incident Activities ​

8.1 Root Cause Analysis ​

8.2 Remediation Planning ​

8.3 Lessons Learned ​

9. Regulatory Reporting ​

9.1 DOT/FMCSA Notifications ​

9.2 Data Breach Notifications ​

10. Testing & Training ​

10.1 Tabletop Exercises ​

10.2 Training Requirements ​

11. Document Control ​