Refresh outage: notification and dated commitments

Declan, I would rather you heard this from me than from anyone else. We have had an outage with the data refresh, and I am writing to you the same day, before you have asked. What I can say now is that the nightly refresh did not complete as it should. I do not yet have the root cause confirmed, and I am not going to offer you one that has not been verified by our platform team. Theo is copied. He will do three things with the platform team and send them to you in writing: confirm the timeline of the incident, confirm which data was affected, and give you a dated commitment for the corrective action. He will attach evidence, and he will not describe a draft as final. If there is anything you need for the register of information, tell me what form you need it in. Best regards, Matteo

Matteo, Thank you for writing on the day. I note that you told me first, and without being asked. That is recorded. A notification is not a closure, however. Under DORA we need the following in writing, with evidence: First, the start and end of the incident and the time you identified it. Second, the data and services affected, and whether anything relating to Ardcarne's evaluation was touched. Third, the confirmed root cause, as distinct from the working explanation. Fourth, the corrective action, with owner. Please provide a dated commitment for the third and fourth items. A verbal assurance will not be sufficient for the register of information, and I will not close the finding without it. Please have Theo send the evidence directly to me. Regards, Declan Furlong, CISO