Security Incident Notification

• Security Incident — May include unauthorized access, data exposure or loss, account/system compromise, Package impersonation, infrastructure-security incidents, or other events affecting confidentiality, integrity, or availability.
• Detection and intake — Incidents may be identified through Monitoring, Security Logs, internal reports, Vulnerability Reporting, service providers, or customer information.
• Initial assessment — Vietnam Office determines affected systems, data categories, potentially impacted users, severity, and risk scope.
• Containment — Appropriate measures may be taken to limit incident scope, protect unaffected systems, and prevent further impact.
• Investigation — Vietnam Office analyzes the cause, timing, scope, affected data or systems, and required evidence to determine the nature of the incident.
• Remediation — May include defect correction, configuration changes, Security Updates, Credential/Key rotation, component isolation, strengthened controls, or other appropriate technical/operational measures.
• Notification principle — Vietnam Office provides notification when an incident meets the applicable notification threshold under law, contract, policy, or risk assessment.
• Notification content — Where appropriate, notification may include the nature of the incident, identified impact scope, affected data or products, actions taken, and steps users should take.
• Notification channels — Notification may be delivered through email, website, Trust Center, Support Center, in-product notice, or other official channels depending on the situation.
• Timing of notification — Notifications are made within timelines appropriate to applicable obligations and the amount of information that can reasonably be confirmed at that time.
• Follow-up updates — For prolonged or complex incidents, Vietnam Office may provide additional updates when important new information or further remediation becomes available.
• Regulatory notification — Where required by law, Vietnam Office reports to or cooperates with competent authorities under applicable requirements.
• Post-Incident Review — After an incident, Vietnam Office may review root cause, response effectiveness, preventive measures, and required improvements to Security Controls.

Security Incident principle: detect → assess → contain → investigate → remediate → notify where required → follow up → improve controls to reduce recurrence risk.