Should I set up an incident response team or is a phone list enough?

Tacking a phone list to the wall isn't enough but don't write a fifty-page manual either. Print a single laminated sheet: 1) Unplug the network cable, do not shut down the computer (so you don't destroy evidence). 2) Notify Ahmet. 3) Call the external IT specialist. 4) Never enter credentials on any suspicious prompt. In a five-person office, the only thing that saves you is your reaction in the first five minutes.

We went through a similar incident last year at our logistics company of seven people. We had no procedures in place, and the external incident response specialist we brought in billed us 180 EUR an hour, totaling 2,200 EUR. If we had signed a retainer agreement from the start at 120 EUR a month, our systems would have been down for just an hour instead of six, and our costs would have been cut in half.

Employees pulling the plug and shutting down devices during an attack is the biggest mistake you can make from a digital forensics perspective. When a machine powers off, attacker traces and encryption keys stored in volatile memory (RAM) are lost. When defining roles within your team, train your technical staff to sever network connectivity (turning off Wi-Fi, unplugging the Ethernet cable) while strictly enforcing the rule to leave the machine running.

Trying to set up a committee in a five-person office sounds ridiculous to me. Everyone already sits right next to each other anyway. Let's be realistic: no one on the inside is going to magically turn into a security expert. What actually matters is knowing who to call on the outside and regularly testing that your backups are truly kept in an isolated environment. Formal team titles are just a waste of paper.

This happened to us at our three-partner agency in Turin. One morning, a ransom note popped up on the accounting computer. Nobody dared to call the boss, and the intern installed some cleanup tool they found on Google which wiped all the logs. In the end, because we notified the Italian data protection authority (Garante) late, we faced the risk of thousands of euros in administrative fines. All because the chain of authority was never made clear.

there are three of us we set up a shared whatsapp group if anything happens we just text there and the tech lead from our outsourced it firm is in the group too. tbh handled two suspicious emails instantly so far no need to go digging through call lists or whatever.

What do your client contracts stipulate in the event of a potential data breach? Under Italian law, you have a 72-hour notification window. Legally, who in your company holds the authority to make the official announcement to clients and regulatory authorities within those 72 hours? When assembling a response team, have you established this signing authority beyond just the technical roles?

To sum up the discussion, the formula for a five-person company is straightforward: designate a single internal decision-maker, train staff to leave devices powered on and merely cut the internet connection, and retain an external IT provider with guaranteed response times. You need neither a bureaucratic committee nor a passive phone list.

Noted, thanks.

Saved.

Do you think this works at any scale? If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

I'm also curious if anyone does it differently.

I didn't know that.

I went through the same thing.

Let me summarize the topic, since several different answers were given. When we decide without measuring, we always end up in the same place.

Good luck with that.

I was thinking the same thing. If you scold false alarms, nobody will report again.

Proven by experience.

It's rare to find an explanation this clear. Payment information changes are never verified through the channel they came from.

The answer varies greatly by industry; there is no one-size-fits-all rule. Just leaving this note, it might be useful.

i agree with this. hasty decisions become decisions you have to fix six months later.

an automated scan report is not the same as a penetration test.

Thanks for writing this, that's the right way. If you don't write this down from the start, it leads to arguments later.

I'm also curious if anyone does it differently.