Private: Viva – Executive Assistants Incident and Breach notification

Incident and Breach notification

Last updated: Apr 7, 2025

At Exec Viva Inc. (“Viva”), we are committed to protecting the personal data and sensitive information entrusted to us by our customers, contractors, employees, and partners. This policy outlines the steps we take to detect, investigate, respond to, and notify relevant parties in the event of a data breach or cybersecurity incident.

1. Scope

This policy applies to all personnel at Viva and covers:

  • The detection and reporting of cybersecurity incidents or data breaches;
  • The internal investigation and mitigation process;
  • Notification to affected parties, regulators (if applicable), and other stakeholders.

 

2. Reporting a Breach

All Viva personnel must immediately report any actual or suspected data breach or cybersecurity incident to the designated Incident Response Lead. This obligation is documented in Viva’s Internal Handbook.

Reports must be made without delay and must include all known information, including:

  • Date and time of the incident (or discovery);
  • Systems, data, or individuals affected;
  • Description of the event;
  • Any immediate containment actions taken.

 

3. Incident Investigation and Containment

Upon receiving a report, the Incident Response Lead will:

  • Confirm and classify the incident;
  • Contain the breach to limit further exposure;
  • Preserve all relevant evidence;
  • Gather and document facts, including affected systems, data types, and scope;
  • Conduct a risk assessment for individuals and Viva’s operations;
  • Consult legal counsel and other internal/external stakeholders as needed.

If necessary, a cross-functional Incident Response Team will be activated to coordinate the investigation and response.

 

4. Notification Protocol

If the incident is determined to involve personal data or confidential information, the following steps will be taken:

a. Internal Notification

  • Notify Viva’s leadership and relevant internal teams;
  • Document the findings, risk level, and recommended remediation.

b. External Notification

We will notify affected customers, partners, and third parties without undue delay if the incident poses a risk to their data or operations. Notifications will include:

  • A description of the incident;
  • The types of data or systems affected;
  • Steps taken or planned to address the incident;
  • Recommended actions customers should take to protect themselves.

Where legally required, we will also notify applicable regulators or authorities.

 

5. Documentation and Remediation

The Incident Response Lead will maintain a written record of:

  • All facts surrounding the incident;
  • Investigation findings;
  • Actions taken to remediate and mitigate future risk;
  • Communications with third parties and regulators.

Remedial actions may include process improvements, security enhancements, training, and follow-up reviews.

 

6. Cyber Liability Insurance Coverage

Viva maintains Cyber Liability Insurance to ensure swift and effective response in the event of a cybersecurity incident.

Our coverage includes:

  • 24/7 access to a dedicated cyber incident response hotline;
  • Engagement with a professional cyber incident response team;
  • Initial advisory and threat intelligence services;
  • Remote support to assess, contain, and resolve the cyber event.

This coverage enables us to respond efficiently, minimize damage, and maintain trust with our clients and partners.

 

7. Continuous Improvement

Viva reviews and updates this policy periodically to ensure compliance with industry standards, evolving threats, and regulatory requirements. We are committed to transparency and resilience in all aspects of data protection.