Executive Summary

Clockwork’s cybersecurity program is designed to protect customer data, ensure service resilience, and earn long-term trust from enterprise customers. Security at Clockwork is treated as an operational discipline, embedded across people, processes, and technology, rather than a one-time compliance exercise.

Our approach combines clear governance, a risk-based incident response model, regular testing and training, and transparent customer communication. As Clockwork scales, this foundation is being formalized and strengthened through a structured roadmap toward SOC 2 Type II certification, targeted for July 2026.
 
Security Governance and Accountability

Clockwork maintains clear ownership and accountability for cybersecurity across the organization:

• A designated Security Delegate is responsible for cybersecurity decision-making, incident classification, escalation, and closure.

• Executive management and legal counsel are directly involved in breach determination, regulatory considerations, and external communications.

• All employees and contractors share responsibility for identifying and reporting suspicious activity or potential security issues.

​

This governance model ensures fast decision-making, executive visibility, and consistent handling of security risks.
 
Risk-Based Incident Management

Clockwork applies a structured, severity-based approach to managing security events and incidents:

• Security events are observable occurrences that may affect confidentiality, integrity, availability, or privacy.

• Security incidents are confirmed events with actual or potential impact to systems or data.

Incidents are classified into four severity levels (P3 to P0), ensuring proportional response:

• P3–P2 (Low / Medium): Suspicious or limited-impact issues requiring investigation and tracking.

• P1 (High): Credible threats or exposures with a strong likelihood of compromise.

• P0 (Critical): Active exploitation, material data exposure, or threats to safety.

​

Each severity level has defined escalation paths and remediation targets, enabling timely and consistent response.
 
Incident Response Lifecycle

​

Clockwork follows an industry-aligned, end-to-end incident response lifecycle:

1. Detection and Reporting – Rapid identification and internal reporting of security issues.

2. Triage and Analysis – Severity assessment, scope evaluation, and containment decisions.

3. Investigation and Identification – Root cause analysis and forensic investigation.

4. Containment and Eradication – Immediate actions to stop exploitation and remove threats.

5. Recovery and Remediation – Restoration of systems, services, and data integrity.

6. Lessons Learned – Long-term remediation and control improvements.

​

For critical incidents, Clockwork activates a dedicated response structure with focused communication channels, daily coordination, and executive oversight until resolution.
 
Transparency and Customer Communication

​

Clockwork prioritizes clear and timely communication with customers:

• Customers are notified within 24 hours of confirming an incident that may impact their data, services, or operations.

• Notification triggers include unauthorized data access, significant service disruption, malware affecting customer-facing systems, or supplier incidents with downstream impact.

• Communication channels include direct email notifications, customer portals, and account-level outreach for strategic customers.

​

All external communications are reviewed by executive management and legal counsel to ensure accuracy, consistency, and regulatory alignment.
 
Preparedness, Testing, and Training

​

Clockwork maintains incident readiness through regular testing and training:

• Annual tabletop exercises to validate decision-making and communication.

• Technical drills to test detection, containment, forensics, and recovery capabilities.

• Periodic communication tests to ensure escalation paths and contact information remain current.

​

Incident responders receive role-based training and regular refreshers to ensure consistent execution under pressure.
 
Continuous Improvement and SOC 2 Roadmap

​

Clockwork’s cybersecurity program is designed to mature over time. The company is actively working toward SOC 2 Type II certification by July 2026, building on existing operational controls.

• Current state: Defined incident response processes, clear security ownership, regular testing, and transparent customer communications.

• 2025: Alignment of controls to SOC 2 Trust Services Criteria, formal risk assessments, expanded monitoring, and vendor risk management.

• 2026: SOC 2 Type II audit completion, independent validation of control effectiveness, and metrics-driven optimization.

​

Throughout this journey, Clockwork measures security effectiveness using operational and risk-based metrics such as time to detect and respond, training completion, test coverage, and remediation tracking. Upon completion, SOC 2 reports will be made available to qualified customers under NDA.