Incident Response Plan : Amazon Marketplace (MWS) Developer Assessment form assistance

i want to to Register on MWS as Developer, but there is still one point, which have be to done, see this Answer from Amazon. Thank you for submitting your Amazon Marketplace Web Service (MWS) Developer Registration and Assessment form. We appreciate the time and effort you have put into clarifying your compliance with our Acceptable Use Policy and Data Protection Policy. After reviewing your responses, we identified the following areas that do not meet the requirements outlined in our policies for accessing Personally Identifiable Information (PII). In order to maintain access to PII, you must update your application to meet the following MWS policy requirements: 1. Data Protection Policy - Incident Response Plan: Developers must create and maintain a plan and/or runbook to detect and handle Security Incidents. Such plans must identify the incident response roles and responsibilities, define incident types that may impact Amazon, define incident response procedures for defined incident types, and define an escalation path and procedures to escalate Security Incidents to Amazon. Developers must review and verify the plan every six (6) months and after any major infrastructure or system change. Developers must investigate each Security Incident, and document the incident description, remediation actions, and associated corrective process/system controls implemented to prevent future recurrence (if applicable). Developers must maintain the chain of custody for all evidences or records collected, and such documentation must be made available to Amazon on request (if applicable). Developers must inform Amazon (via email to security@[login to view URL]) within 24 hours of detecting any Security Incidents. Developers cannot notify any regulatory authority, nor any customer, on behalf of Amazon unless Amazon specifically requests in writing that the Developer do so. Amazon reserves the right to review and approve the form and content of any notification before it is provided to any party, unless such notification is required by law, in which case Amazon reserves the right to review the form and content of any notification before it is provided to any party. Developers must inform Amazon within 24 hours when their data is being sought in response to legal process or by applicable law.