Incident Response & Resilience

The Principle

‍

Resilience is not the absence of incidents. It is the ability to absorb them, contain them, recover from them, and emerge stronger. Every organization that operates at the intersection of healthcare, government, artificial intelligence, and global security will face security events. The measure of an institution is not whether incidents occur — it is how rapidly they are detected, how effectively they are contained, how transparently they are communicated, and how thoroughly the organization recovers.

Ariana Nexus maintains a documented and tested Incident Response Plan, a Business Continuity and Disaster Recovery Plan, cyber liability insurance coverage, and a cloud-native operational architecture that enables recovery within hours of any disruption. These are not aspirational capabilities. They are operational today.

‍

Incident Response Program

‍

Framework Alignment

The Ariana Nexus Incident Response Plan (IRP) is aligned with NIST SP 800-61 Rev. 3 (Incident Response Recommendations and Considerations for Cybersecurity Risk Management, finalized April 2025), which supersedes Rev. 2 and integrates incident response into the broader cybersecurity risk management lifecycle. The IRP has been documented, reviewed, approved by organizational leadership, and tested through tabletop exercises.

The IRP addresses the full spectrum of security events — from low-severity policy violations to critical data breaches — and provides structured procedures for detection, analysis, containment, eradication, recovery, and post-incident improvement.

‍

Incident Response Lifecycle

The IRP follows the incident response lifecycle informed by NIST SP 800-61 Rev. 3, which recommends integrating incident response into cybersecurity risk management rather than treating it as a standalone process. The operational phases below reflect the Rev. 3 recommendations while maintaining the four-phase structure for procedural clarity:

‍

Phase 1: Preparation

Preparation is the foundation of effective incident response. Ariana Nexus maintains the following preparedness measures:

Personnel and Roles:

• Incident response roles and responsibilities are formally assigned. The CEO and Founder currently serves as the Incident Response Lead, with direct authority over containment, notification, and recovery decisions.
• All personnel are trained on incident recognition and reporting procedures during onboarding and through annual refresher training.
• Escalation paths are documented for each severity level, including contact information for external parties (legal counsel, cyber insurance carrier, regulatory authorities, client contacts).

Tools and Access:

• The Incident Response Lead has pre-provisioned access to Microsoft 365 Defender portal, Microsoft Entra ID administrative console, Microsoft Purview compliance portal, and Microsoft Intune device management console.
• Investigation tools include Microsoft 365 Unified Audit Log, Entra ID sign-in logs, Defender threat explorer, and Purview DLP incident reports.
• Evidence preservation procedures are documented, including log export, mailbox hold, and device isolation protocols.

Communication Templates:

• Pre-drafted notification templates are maintained for client notification (per Engagement Agreement and BAA requirements), regulatory notification (HIPAA, DFARS, GDPR, state breach notification), law enforcement notification, and internal all-hands communication.
• Templates are reviewed annually and updated to reflect changes in regulatory requirements or engagement-specific obligations.

Testing:

• The IRP is tested through tabletop exercises that simulate realistic incident scenarios, including phishing compromise, credential theft, PHI exposure, CUI exfiltration, and ransomware. Lessons learned from exercises are incorporated into the IRP.
• Testing cadence: annually at minimum, and following any significant incident or material change to the environment.
  ‍

Phase 2: Detection and Analysis

Automated Detection:

• Microsoft Defender for Office 365 detects email-borne threats (malware, phishing, BEC) and generates alerts.
• Microsoft Entra ID Protection detects identity-based threats (risky sign-ins, compromised credentials, atypical travel) and generates risk scores.
• Microsoft Purview DLP detects data movement violations and generates incident reports.
• Microsoft Intune detects device compliance failures and triggers access restrictions.

Alert Triage:

• All alerts are reviewed by the Incident Response Lead through the Microsoft 365 Defender unified incident queue.
• Alerts are triaged based on severity, scope, and data classification of affected assets.
  ‍

Severity Classification:

‍

Critical — Active breach of PHI, CUI, or Restricted data; active intrusion; ransomware; threat to physical safety of individuals. Response target: Immediate (within 1 hour). Notification: CEO, legal counsel, cyber insurance carrier, affected clients, regulatory authorities as required.

High — Confirmed credential compromise; successful phishing with data access; Confidential data exposure; DLP violation involving sensitive data. Response target: Within 4 hours. Notification: CEO, affected engagement lead, legal counsel if client data involved.

Medium — Suspicious activity requiring investigation; blocked threat with investigation needed; Internal data DLP trigger. Response target: Within 24 hours. Notification: CEO, security log documentation.

Low — Informational alerts; routine vulnerability advisories; spam escalation. Response target: Within 72 hours. Notification: Logged for trend analysis.

Evidence Collection:

• Upon identification of a Medium severity or higher incident, the Incident Response Lead initiates evidence preservation: audit log export, affected mailbox litigation hold, affected device quarantine, screenshot capture, and timeline documentation.
• All evidence is stored in a secure, access-restricted location within the Microsoft 365 environment with Restricted-tier Sensitivity Label applied.
  ‍

Phase 3: Containment, Eradication, and Recovery

Containment (Stop the Bleeding):

• Account Compromise: Compromised user accounts are immediately disabled in Microsoft Entra ID. All active sessions are revoked. MFA credentials are reset. The account is not re-enabled until the investigation confirms the threat has been eliminated.
• Device Compromise: Affected devices are remotely wiped or quarantined through Microsoft Intune. Device access to all Microsoft 365 resources is blocked through Conditional Access.
• Email-Borne Threats: Malicious emails are purged from all mailboxes using Defender threat explorer. Safe Attachments and Safe Links policies are reviewed and strengthened if the threat bypassed existing rules.
• Data Exposure: Exposed documents are immediately restricted through Purview Sensitivity Label upgrade to Restricted. External sharing links are revoked. DLP policies are reviewed and tightened.
• Lateral Movement Prevention: Conditional Access policies are reviewed and tightened. Privileged account access is suspended pending investigation. Network segmentation is verified.

Eradication (Remove the Threat):

• Root cause is identified through forensic analysis of audit logs, sign-in logs, email headers, device telemetry, and DLP reports.
• Malware is removed from affected systems. Compromised credentials are revoked and reissued. Vulnerable configurations are corrected. Exploited vulnerabilities are patched.
• If the incident involves a third-party service, the third party is notified and their response is coordinated.

Recovery (Restore Operations):

• Affected systems are restored from verified clean state. For data loss scenarios, restoration from the third-party backup system is initiated.
• Enhanced monitoring is applied to previously affected accounts, devices, and data stores for a minimum of thirty (30) days post-recovery to detect indicators of re-compromise.
• Business operations are resumed only after the Incident Response Lead confirms that the threat has been fully remediated and that the environment is in a secure state.
  ‍

Phase 4: Post-Incident Activity

Post-Incident Review:

• Every incident classified at Medium severity or above receives a formal Post-Incident Review (PIR) within five (5) business days of resolution.
• The PIR documents the complete incident timeline (detection → containment → eradication → recovery), root cause analysis, data and systems affected, impact assessment (data exposure scope, individuals affected, regulatory implications), response effectiveness evaluation, and corrective actions and recommendations.

Corrective Actions:

• Identified gaps in prevention, detection, or response are addressed through specific corrective actions: policy updates, configuration changes, additional training, technology enhancements, or process improvements.
• Each corrective action is assigned an owner, a target completion date, and a verification method.
• Corrective action completion is tracked and verified by the Incident Response Lead.

IRP Update:

• The Incident Response Plan is updated to incorporate lessons learned from every Medium+ incident and every tabletop exercise. The IRP version history is maintained as part of the Ariana Nexus governance documentation.
  ‍

Notification Obligations

‍

Ariana Nexus maintains documented notification procedures for all applicable regulatory, contractual, and legal obligations:

‍

Client Notification

• Where an incident affects client data, Ariana Nexus notifies the affected client in accordance with the applicable Engagement Agreement, Business Associate Agreement, or Data Processing Agreement.
• Notification includes a description of the incident, the data affected, the containment and remediation actions taken, and recommendations for the client's own response.
• Ariana Nexus coordinates with the client's security and legal teams throughout the incident lifecycle.

HIPAA Breach Notification (PHI)

• As a Business Associate, Ariana Nexus notifies the applicable Covered Entity of a breach of unsecured PHI within thirty (30) days of discovery, in accordance with the HITECH Act (42 U.S.C. § 17932) and 45 CFR § 164.410.
• Notification includes the identification of each individual affected (to the extent known), a description of the types of PHI involved, the corrective actions taken, and procedures for individuals to protect themselves.
• For breaches affecting 500 or more individuals, Ariana Nexus supports the Covered Entity's obligations to notify HHS and the media within the required timeframes under 45 CFR §§ 164.404 and 164.408.

DFARS Cyber Incident Reporting (CUI)

• For cyber incidents affecting Controlled Unclassified Information, Ariana Nexus reports the incident to the applicable government contracting authority and submits a report to the DoD Cyber Crime Center (DC3) within seventy-two (72) hours of discovery, in accordance with DFARS 252.204-7012.
• The report includes the required elements specified in DFARS 252.204-7012(c), including a description of the technique or method used, a sample of the malicious software (if applicable), and a summary of the affected systems and data.

GDPR Breach Notification (EU/UK)

• For personal data breaches affecting individuals in the European Economic Area, Ariana Nexus notifies the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR Article 33.
• Where the breach is likely to result in a high risk to the rights and freedoms of individuals, Ariana Nexus notifies the affected individuals without undue delay, in accordance with GDPR Article 34.
• For breaches affecting individuals in the United Kingdom, notification is provided to the Information Commissioner's Office (ICO) within the same seventy-two (72) hour timeframe under the UK GDPR.

U.S. State Breach Notification

• Ariana Nexus complies with the breach notification laws of all U.S. states and territories, including Virginia (Va. Code § 18.2-186.6), Delaware (6 Del. Code § 12B-102), California (Cal. Civ. Code § 1798.82), and all other applicable jurisdictions.
• Notification is provided to affected individuals and the applicable state attorney general within the timeframes required by each state's law.

Law Enforcement

• Where an incident involves suspected criminal activity, Ariana Nexus cooperates with law enforcement authorities as appropriate, while preserving the rights of affected individuals and the confidentiality of client data to the maximum extent permitted by law.
  ‍

Business Continuity and Disaster Recovery

‍

Business Continuity Plan (BCP)

Ariana Nexus maintains a documented Business Continuity Plan that ensures the organization can continue delivering critical services during and after a disruptive event. The BCP addresses scenarios including extended platform outages, natural disasters affecting personnel or facilities, pandemic or public health emergencies, supply chain disruptions, cyberattack with extended remediation, and loss of key personnel.

Cloud-Native Resilience:

Ariana Nexus operates a fully cloud-native infrastructure within the Microsoft 365 ecosystem. There is no on-premises data center, no single-point-of-failure hardware, and no geographic dependency on a physical office location. This architecture provides inherent resilience:

• All data is stored in Microsoft 365 cloud services (SharePoint, OneDrive, Exchange, Teams) with Microsoft's built-in geo-redundant replication across multiple data centers.
• All applications are cloud-based and accessible from any location with internet connectivity and an authenticated, compliant device.
• All personnel are equipped to work remotely using their enrolled, managed devices with full access to the Microsoft 365 environment through Conditional Access-governed connections.

Recovery Time:

In the event that the primary work environment becomes unavailable — whether due to a Microsoft 365 service disruption, a natural disaster affecting the Washington, D.C. metropolitan area, or any other disruptive event — Ariana Nexus can resume critical operations within hours. This is possible because the entire operational environment is cloud-based, distributed, and device-independent. Personnel can continue working from any location with internet access using their enrolled devices.

Recovery Objectives:

Recovery Time Objective (RTO) — 4 hours for critical services; 24 hours for full operations. Basis: Cloud-native architecture; no on-premises dependencies.

Recovery Point Objective (RPO) — Near-zero for M365 data (continuous replication); 24 hours for third-party backup. Basis: Microsoft geo-redundant replication + daily third-party backup.

Maximum Tolerable Downtime (MTD) — 48 hours for critical services. Basis: Based on client SLA commitments and regulatory obligations.

Disaster Recovery Plan (DRP)

The Disaster Recovery Plan addresses the technical recovery of systems and data following a disruptive event:

Microsoft 365 Platform Resilience:

• Microsoft 365 services operate across geographically distributed data centers with built-in failover, load balancing, and data replication. Microsoft's SLA for Microsoft 365 services guarantees 99.9% uptime.
• SharePoint and OneDrive maintain version history for all files, enabling point-in-time recovery.
• Exchange Online maintains deleted item retention and mailbox recovery capabilities.

Third-Party Backup:

• Ariana Nexus maintains a third-party backup solution that provides independent, encrypted backup of all Microsoft 365 data (SharePoint, OneDrive, Exchange, Teams).
• Backups are stored in a geographically separate, encrypted environment independent of Microsoft's infrastructure.
• Backup frequency: daily incremental, weekly full.
• Restore testing: conducted semi-annually to verify backup integrity and recoverability.
  ‍

Disaster Recovery Scenarios and Procedures:

‍

Microsoft 365 regional outage — Operations continue via Microsoft failover to secondary region; team works from alternate devices if needed. RTO: 0–4 hours (Microsoft-managed failover).

Ransomware / destructive malware — Isolate affected accounts and devices; restore from third-party backup to clean state; re-provision credentials. RTO: 4–24 hours.

Loss of primary office location — All personnel switch to remote work; all systems accessible via cloud. RTO: 0–2 hours.

Compromise of administrative credentials — Break-glass account activation; credential reset; environment audit; enhanced monitoring. RTO: 1–4 hours.

Loss of key personnel — Documented procedures and cross-training ensure continuity; break-glass credentials accessible to designated alternates. RTO: Hours to days depending on role.

Extended internet disruption — Offline work capability; tethered mobile connectivity as backup; priority restoration of connectivity. RTO: Variable.

‍

BCP/DRP Testing

• The BCP and DRP are tested through tabletop exercises and operational drills at least annually.
• Testing scenarios are rotated to cover different disruption types and ensure broad organizational readiness.
• Test results, identified gaps, and corrective actions are documented and incorporated into plan updates.

Cyber Liability Insurance

‍

Ariana Nexus maintains cyber liability insurance coverage to provide financial protection against the costs associated with security incidents, data breaches, and related liabilities. Coverage includes:

• Incident Response Costs: Forensic investigation, legal counsel, notification costs, credit monitoring for affected individuals, and public relations support.
• Regulatory Defense and Penalties: Coverage for regulatory investigations, defense costs, and fines or penalties to the extent insurable under applicable law.
• Business Interruption: Coverage for revenue loss and extra expenses resulting from a qualifying cyber event.
• Third-Party Liability: Coverage for claims by clients, individuals, or other third parties arising from a data breach or security failure.
• Data Restoration: Costs associated with restoring or recreating data lost or corrupted as a result of a cyber incident.

Policy Details:

• Coverage limits and policy details are maintained in confidence and are available for review by clients under NDA as part of the engagement due diligence process.
• The cyber insurance carrier is a nationally recognized insurer with AM Best financial strength rating of A (Excellent) or higher.
• The policy is reviewed annually and adjusted as Ariana Nexus's risk profile, client base, and regulatory obligations evolve.
  ‍

Why This Matters for Clients:

Cyber liability insurance provides an additional layer of financial assurance beyond technical controls. In the event of an incident affecting client data, the insurance coverage ensures that Ariana Nexus has the financial resources to conduct a thorough investigation, provide required notifications, remediate the root cause, and satisfy any resulting liabilities — without compromising the organization's financial stability or ability to continue serving its clients.

‍

Alignment with Security and Compliance Frameworks

‍

Ariana Nexus's incident response and resilience architecture is designed in alignment with the following recognized frameworks and standards:

NIST SP 800-61 Rev. 3 (April 2025) — Incident response integrated into cybersecurity risk management; supersedes Rev. 2. Aligned — documented and tested IRP updated to Rev. 3 recommendations; four-phase operational structure retained for procedural continuity.

NIST SP 800-34 Rev. 1 — Contingency planning (BCP/DRP). Aligned — documented BCP and DRP with defined RTO/RPO.

NIST SP 800-171 Rev. 2 / Rev. 3 — Incident Response (IR), Contingency Planning (CP) families. Aligned — IRP, BCP, DRP, and backup procedures implemented (Rev. 2 current for DoD/CMMC; Rev. 3 transition planned per DoD rulemaking).

NIST Cybersecurity Framework 2.0 — Respond (RS), Recover (RC) functions. Aligned — response and recovery procedures documented and tested.

HIPAA Security Rule (45 CFR § 164.308) — Contingency plan (§ 164.308(a)(7)), security incident procedures (§ 164.308(a)(6)). Aligned — IRP, BCP, DRP, backup, and emergency access procedures documented.

HIPAA / HITECH Breach Notification — BA notification within 30 days. Aligned — 30-day commitment documented.

DFARS 252.204-7012 — Cyber incident reporting within 72 hours. Aligned — 72-hour DC3 reporting commitment documented.

GDPR (Articles 33, 34) — Breach notification within 72 hours to supervisory authority. Aligned — notification procedures documented.

NIS2 Directive (Article 21) — Cybersecurity risk management including incident handling. Aligned — incident response procedures satisfy NIS2 Article 21 requirements (applicable when EU offices operational).

SOC 2 (Trust Services Criteria) — CC7 — System Operations, CC9 — Risk Mitigation. Roadmap (2026–2027) — controls operational, audit planned.

ISO 27001:2022 — Annex A.5.24–A.5.28 (Incident Management), A.5.29–A.5.30 (Business Continuity). Roadmap (2027) — IRP and BCP aligned, certification planned.

CMMC Level 2 — Incident Response (IR) domain. Roadmap (2027) — controls implemented, certification planned.

ISO 22301:2019 — Business Continuity Management Systems. Roadmap (2028) — BCP operational, formal certification evaluated.

‍

Sector-Specific Resilience

Healthcare (HIPAA)

Healthcare engagements require uninterrupted availability of interpretation, translation, and cultural competency services. The BCP addresses healthcare-specific continuity requirements, including interpreter availability for emergency medical situations, compliance with HIPAA contingency plan requirements (45 CFR § 164.308(a)(7)), and the ability to maintain access to PHI-containing environments during and after a disruption.

Government (CUI / NIST 800-171)

Government engagements require compliance with the NIST SP 800-171 Contingency Planning (CP) control family, including contingency plan development (CP-2), contingency training (CP-3), contingency plan testing (CP-4), and system backup (CP-9). Ariana Nexus's BCP and DRP address all CP family controls, with formal documentation planned as part of the System Security Plan (SSP) development for CMMC Level 2 certification.

AI & Technology (AI Data Factory)

AI engagements require resilience of annotation pipelines, quality assurance workflows, and training data environments. The DRP addresses recovery of AI Data Factory environments, including restoration of datasets from backup, re-provisioning of annotator access, and verification of data integrity post-recovery.

Diaspora and Sensitive Population Data

Engagements involving Afghan diaspora data require particular attention to data safety during and after incidents. The IRP classifies any unauthorized access to sensitive population data as a Critical-severity incident regardless of volume, and the BCP prioritizes continuity of services that protect vulnerable individuals.

What Incident Response and Resilience Means for Our Clients and Partners

‍

For procurement officers: Ariana Nexus has a documented and tested Incident Response Plan, a Business Continuity Plan, a Disaster Recovery Plan, third-party backup, and cyber liability insurance. We can provide evidence of each during your due diligence process.

For CISOs: Our IRP follows NIST SP 800-61 Rev. 3 with a four-level severity matrix and defined response targets. Our cloud-native architecture provides a 4-hour RTO for critical services. Our third-party backup delivers near-zero RPO for cloud data and 24-hour RPO for full backup.

For compliance officers: Our notification commitments satisfy HIPAA BA (30 days), DFARS (72 hours), GDPR (72 hours), and all applicable state breach notification laws. Post-incident reviews with corrective actions are conducted for every Medium+ incident.

For government contracting officers: Our IRP and BCP address the NIST SP 800-171 IR and CP control families. Our DFARS 252.204-7012 cyber incident reporting commitment is documented and operational. Our CMMC Level 2 IR and CP domain certification is on the 2027 roadmap.

If your organization requires incident response plan review, business continuity documentation, or a resilience architecture briefing, contact trust@ariananexus.com or +1 (202) 771-0224.

‍

Maturity Roadmap

‍

Ariana Nexus views incident response and resilience as a multi-year journey. The following roadmap reflects our planned maturation path:

Phase 1: Foundation (Current — 2026) — Operational

Documented and tested IRP (NIST SP 800-61 Rev. 3). Documented BCP and DRP. Severity classification matrix with defined response targets. Notification procedures for HIPAA, DFARS, GDPR, and state laws. Third-party backup with semi-annual restore testing. Cyber liability insurance. Cloud-native operations with 4-hour RTO.

Phase 2: Hardening (Q3–Q4 2026) — In Planning

Automated incident triage playbooks. Enhanced tabletop exercise program with sector-specific scenarios. Client notification workflow automation. Insurance coverage review and adjustment.

Phase 3: Security Operations Build (2027) — Planned

Security Operations Lead assumes incident command. Microsoft Sentinel (SIEM/SOAR) for automated detection-to-response. SOC 2 Type II audit (CC7, CC9). CMMC Level 2 IR domain certification. Formal on-call rotation.

Phase 4: Advanced (2028) — Planned

24/7 incident response capability (internal SOC or MSSP). Red team / purple team exercises. ISO 27001 A.5.24–A.5.30 certification. ISO 22301 BCP certification evaluation. Integration with client incident response programs.

Phase 5: Autonomous (2030+) — Vision

AI-augmented incident detection and automated containment. Predictive resilience modeling. Multi-region disaster recovery architecture. Quantum-threat incident response procedures.

‍

Limitation of Liability and Disclaimers

‍

No Guarantee Against Incidents. Ariana Nexus maintains a documented and tested incident response program and business continuity plan. However, no incident response program can prevent all security incidents, and no business continuity plan can guarantee uninterrupted operations under all circumstances. Ariana Nexus expressly disclaims any warranty or guarantee of incident-free operations or absolute operational resilience.

Response Time Targets. Response times stated in this page represent targets based on the severity classification matrix and the current operational model. Actual response times may vary based on incident complexity, concurrent incidents, personnel availability, and external factors beyond Ariana Nexus's reasonable control. Response time targets are not service-level agreements unless specified in an applicable Engagement Agreement.

Recovery Objectives. RTO and RPO targets represent planning objectives based on the current cloud-native architecture and backup strategy. Actual recovery times may vary based on the nature and scope of the disruption, platform provider recovery times, and the complexity of the restoration required. Ariana Nexus does not guarantee achievement of stated RTO/RPO targets in all circumstances.

Insurance Coverage. Cyber liability insurance coverage is subject to the terms, conditions, exclusions, and limits of the applicable insurance policy. The existence of insurance does not constitute an admission of liability and does not expand Ariana Nexus's legal obligations beyond those established by applicable law and the applicable Engagement Agreement.

Third-Party Dependencies. Incident response and business continuity capabilities depend on the Microsoft 365 platform, third-party backup provider, telecommunications infrastructure, and other services beyond Ariana Nexus's direct control. Ariana Nexus disclaims liability for disruptions attributable to these third-party dependencies.

Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ARIANA NEXUS'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO INCIDENT RESPONSE, BUSINESS CONTINUITY, OR DISASTER RECOVERY SHALL NOT EXCEED THE AMOUNTS SET FORTH IN THE APPLICABLE ENGAGEMENT AGREEMENT, OR, WHERE NO ENGAGEMENT AGREEMENT EXISTS, ONE HUNDRED DOLLARS ($100). ARIANA NEXUS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING FROM OR RELATED TO ANY SECURITY INCIDENT, OPERATIONAL DISRUPTION, OR RECOVERY DELAY. NOTHING IN THIS SECTION SHALL LIMIT OR EXCLUDE ARIANA NEXUS'S LIABILITY FOR: (A) FRAUD OR FRAUDULENT MISREPRESENTATION; (B) DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE; OR (C) ANY OTHER LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED BY APPLICABLE LAW, INCLUDING BUT NOT LIMITED TO LIABILITY UNDER THE UK UNFAIR CONTRACT TERMS ACT 1977, THE UK CONSUMER RIGHTS ACT 2015, OR GDPR.

Dispute Resolution. Any dispute arising out of or relating to this page shall be subject to the dispute resolution provisions in the Terms of Use, Section 18.