RE: Escalation Channels into Verizon’s RISK Team

The Rapid Response Retainer service provides Customer access to the Verizon RISK (Research, Investigations,
Solutions, Knowledge) team for both reactive (e.g., security breach) and proactive (e.g., IR table top exercises)
services. The Retainer service provides a response-based SLA within which Customer will receive service.

Escalation Channels
There are four escalation channels into the Verizon RISK team, including a 24/7 hotline, a primary and alternate
Investigative Liaison, and a Verizon RISK team global email address. These channels should be utilized to
escalate both emergency and non-emergency requests.

Emergency Escalation Channels

An emergency request would consist of all requests that are directly driven by a newly discovered or ongoing
security incident within the Customer’s environment. Examples of emergency requests include, but are not
limited to:
- Data compromise
- Successful subversion (intrusion) of Customer’s security controls
- Signs of application breach
- Allegations from external entities (hackers / customers / business partners / etc.) that Customer’s
systems have been compromised

The four escalation channels should be used in the following sequence:

1) Toll Free Hotline:

USA: + 1 844-819-6071

If your organization has operations in the following countries, the following Toll Free numbers
may be dialed from that country:

Australia 0011 - 80085757575 Luxembourg 00 - 80085757575

Belgium 00 - 80085757575 Brazil 0021 - 80085757575
Czech
Republic 00 - 80085757575 Netherlands 00 - 80085757575
Denmark 00 - 80085757575 Spain 00 - 80085757575
France 00 - 80085757575 Switzerland 00 - 80085757575
Germany 00 - 80085757575 Singapore 001 - 80085757575
Italy 00 - 80085757575 Sweden 00 - 80085757575
Japan - KDD 001 - 010 – 80085757575 United Kingdom 00 - 80085757575
Japan - NTT 0033- 010 - 80085757575 Mexico - ITFS 001-8443106634
Japan -
Softbank 0061 - 010 - 80085757575

Please note that the toll free hotlines are staffed 24 hours a day 365 days a year by a Verizon Security
Operations Center. The objective of every SOC resource will be to collect vital contact information and
basics about the incident from the customer and identify the right investigator who will engage with the
Customer to address the incident.

2) A message to ir-global@one.verizon.com
 3) Louis Archbold (Primary Investigative Liaison)
Mobile: +1(847) 343-6362
Email: louis.archbold@verizon.com

4) Eric Gentry (Secondary Investigative Liaison)

Mobile: +1 (703) 589-7751
Email: eric.gentry@verizon.com

In an emergency response situation, the Customer should start by calling the Toll Free Hotline. In the unlikely
event the Toll Free Hotline is out of service, the next course of action is to send an email message to the ir-
global@one.verizon.com email distribution. The addressees on the distribution are members of Verizon RISK
Team. Each individual is an expert in incident handling and technical forensics. It is important that the email
includes Customer POC information and that Customer is an existing Rapid Response Retainer customer
looking to trigger the retainer service. One example / suggestion for an email message would be:

“This is <Name> with the <Organization> and I am writing because we believe that we have suffered from an
incident and would like to trigger the Investigative Response retainer. Please make contact with <Name> at the
following <Phone / or Email>”

If the Customer knows the name of their designated investigator liaison, that information should be included in
the email to ir-global@one.verizon.com as well.

If the unusual circumstance arises wherein the Toll Free Hotline, and the global email is not available, call the
Primary or Secondary Point of Contact’s mobile phone number. If the individual does not answer, leave a brief
response detailing the situation as noted above.

Non-Emergency Escalation Channel

A non-emergency request would consist of all requests that are not directly driven by an ongoing incident within
the Customer’s environment. Examples of non-emergency requests include:

- Updates on current bank of hours

- Information regarding the way in which hours could be used
- Non-emergency engagement requests such as mock incident testing, training, or policy and process
review

For non-emergency requests, the designated investigator liaison from the Verizon RISK team should be utilized
as the primary escalation channel. This will ensure continuity for Customer and efficient response from relevant
resources within Verizon. The designated investigator liaison for Customer is:

Louis Archbold
Verizon RISK Team
M: +1(847) 343-6362
E: louis.archbold@verizon.com

Under non-emergency circumstances, the Customer’s Primary Point of Contact will return phone calls and
schedule on site meetings in a best effort manner.

Engagement Process
The first step in deploying investigators to the Customer’s site during an emergency response incident is for an
engagement letter to be produced by Verizon and accepted with signature by the Customer. Upon Verizon’s
receipt of the signed engagement letter (Attachment 01 – Engagement Letter Template) from Customer,
Verizon’s SLA for an investigator to be in transit is 48 hours. Note that the 48-hour SLA guarantees that an
investigator will be in-transit to the Customer’s site within 48 hours of the signed engagement letter. This
provision is in place due to the volatility of last minute travel.
Lab Process
Attach a completed evidence submission form and a chain of custody form (or completed form on evidence bag)
for each evidence item submitted to Verizon RISK Labs. Request the form during the engagement scoping
call.

Ship the drives to the following address (Federal Express Priority Overnight—preferred):

Attention; Evidence Custodian

Verizon RISK Labs
210 Pine St
8th floor
Harrisburg, PA 17101
(717) 232-2205 - US Lab on-call number

ATTACHMENT 01 – ENGAGEMENT LETTER TEMPLATE

<Customer> Engagement Letter is being issued pursuant

Rapid Response Retainer to <AGREEMENT> for Verizon Services
(specifically the “Rapid Response Retainer
Engagement ID: <ret_id> Service”) Contract #

<Date>

RE: Engagement Letter

Pursuant to a request from Customer, under the terms of their Rapid Response Retainer contract
referenced above.

Scope of Work:

Service Location:

Deliverable:

Engagement Start Date:

Hours:

Verizon Point of Contact Customer Point of Contact

CUSTOMER SIGNATURE

Authorized Signature:

Name (print):

Title:

Date:

THIS DOCUMENT MUST BE SIGNED BY AN AUTHORIZED CUSTOMER REPRESENTATIVE PRIOR TO

ANY WORK COMMENCING FOR THE SERVICES OUTLINED HEREIN. A COPY OF THIS
ENGAGEMENT LETTER SHALL BE RETAINED ALONG WITH THE AGREEMENT.