The Acuity Brands PSIRT process was developed using the ISO 30111 standard and documentation from the Forum of Incident Response and Security Teams (FIRST) as guides. The following figure provides a high-level view of our response process.

The following are the steps in the process illustrated in Figure 1. After each step is completed, the Acuity Brands PSIRT determines the appropriate actions; therefore, some of these steps might not be performed for some issues.

1. Awareness: information is received regarding a potential security vulnerability
2. Triage: the report is validated, prioritized, and resources identified
3. Analysis: impact assessment is conducted and remediation plan developed
4. Coordination: all collaborators are made aware of the timelines
5. Remediation: fixes are released and cloud-based services are updated
6. Notification: affected customers are notified
7. Feedback: post-remediation activities are performed