Revert by query
Containment revokes the compromised token or freezes the Worker, then reverts every Event written under it as one Change.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC7.4 | The entity responds to security incidents with a defined program to understand, contain, remediate and communicate them. |
| SOC2 CC7.5 | The entity identifies, develops and performs activities to recover from identified security incidents. |
| ISO27001 A.5.26 | Information security incidents are answered according to documented procedures. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Incident that names a compromised token or Worker. |
| Assert | Each has a revocation or freeze, one revert Change spanning every Event written under it, and one Decision. |
Owner
Reliability Engineer, Engineering Team.
Example
A leaked token writes 41 bogus discount codes into a SaaS. Containment revokes the token and reverts all 41 as one Change, recorded with one Decision.