Incident Response & Business Continuity (BC/DR)

Formal 4-phase incident response plan, recovery objectives (RPO=0, RTO<5m), and disaster recovery playbooks.

Last updated: Sep 23, 2026

This document formalizes the Incident Response Plan (IRP) and Business Continuity & Disaster Recovery (BC/DR) architecture for Aarkam storage deployments, complying with NCA ECC-2:2024 §2-14, NCA CSCC-1:2019, and ISO 22301.

1. Incident Response Plan (IRP) Workflow

Aarkam defines a 4-phase response protocol for security and data degradation events:

┌──────────────┐     ┌───────────────┐     ┌───────────────┐     ┌───────────────┐
│  1. Triage   │ ──► │2. Containment │ ──► │3. Eradication │ ──► │4. Post-Mortem │
│ & Detection  │     │  & Isolation  │     │  & Recovery   │     │  & Forensics  │
└──────────────┘     └───────────────┘     └───────────────┘     └───────────────┘

Phase 1: Detection & Triage
- Telemetry signals ingested from Abodi.Agent, IDS/IPS alerts, or WORM audit integrity monitors.
- Incidents categorized by severity: P1 Critical (compromise of HSM or data plane loss), P2 High (Raft quorum degradation), P3 Medium (single node failure).
Phase 2: Immediate Containment
- If an unauthorized access attempt or compromised node is detected, administrators execute emergency containment via CLI:
```
am cluster set-mode --read-only --reason "Security Triage Incident #4081"
am node evict storage-node-03 --force
```
Phase 3: Eradication & Recovery
- Reconstruct at-risk chunks from surviving Cauchy parity blocks.
- Rotate cluster-wide mTLS certificates and tenant session keys.
Phase 4: Post-Mortem & Regulatory Reporting
- Generate cryptographically hashed forensic report via am diagnose report -o incident.json.
- Submit formal incident disclosures to regulatory authorities (NCA / SDAIA) within mandated timelines (within 72 hours under PDPL).

2. Business Continuity & Disaster Recovery Metrics

Aarkam is architected to guarantee enterprise-tier resilience metrics:

Metric	Target	Technical Mechanism
Recovery Point Objective (RPO)	RPO = 0	Synchronous Raft log commit & multi-node quorum write paths.
Recovery Time Objective (RTO)	RTO < 5 Minutes	Autonomous Raft leader election (300ms) & automated hash ring rebalancing.
Cold Disaster Recovery	RTO < 1 Hour	Multi-volume off-cluster snapshots and air-gapped tape/cloud cold replication.

3. Quorum Degradation Playbook

In the event of catastrophic physical facility damage (e.g., loss of a primary datacenter room):

Verify Surviving Quorum:
```
am mon status
```
Promote Surviving Minority (Emergency Recovery Only): If 2 out of 3 coordinators are lost, force single-coordinator recovery mode:
```
am mon force-recovery --node coord-01 --yes
```
Trigger Deep Scrub: Verify all Cauchy parity chunks and begin automated reconstruction to spare nodes:
```
am repair scrub start --priority emergency
```