They are demanding a "cyber incident response team" from us — does a 15-person company really need one?

Big enterprises just copy-paste their internal standards onto vendor agreements. Speak directly with their security team. They know full well that a 15-person shop cannot support an in-house CSIRT. If you provide an external support contract alongside an internal escalation matrix, they will sign off on it.

Our 20-person team in Dubai ran into the exact same clause. We signed an on-call retainer with a security firm for 12,000 AED per year. They committed to a 4-hour response SLA. The client's audit team accepted the documentation, and we closed the deal.

edit: fixed a few typos.

Don't reject the clause outright, but don't sign it blindly either. Propose an addendum stating that the Incident Response Team function is fulfilled via an accredited external security provider backed by an SLA.

Don't mind the account manager saying it's non-negotiable; they're just middlemen. Security clauses are negotiated directly with the client's CISO or risk team. If the data level your company accesses isn't critical, you can even get this clause completely waived.

I recommend consulting your legal counsel before signing the contract. If you make this commitment without an agreement with an external provider and a potential breach occurs, severe liability for damages could arise due to breach of contract.

when this happened to us we put two in-house devs on call rotation but the auditor didnt buy it and i mean getting an annual retainer externally is the cleanest way saves you the headache.

What customer data will you be accessing? Will your systems directly integrate with their servers, or will you just run analytics in an isolated environment? Your access level will be your biggest bargaining chip for relaxing the requirements.

don't panic at all; these kinds of clauses always look scary during enterprise RFPs. btw the goal isn't to sink you it's just to make sure there's an accountable person on the other end of the line if a crisis hits.

i went through the same thinng two years ago. solutions that work at a small scale collapse when you grow; I learned this late.

if you post the result here, it will help others too.

I'll try it.

I have an objection here. Forgotten test environments are more often the entry point than live systems.

When making a decision, first look at what data you have on hand. Of course, it varies if your situation is different.

I didn't know that.

thanks a lot, I'll try it today.. then the harder it is to reverse a decision the slower you should make it.

when making a decision, first look at what data you have on hand. im also cuious if anyone does it differently.

there are three things to check when doing this and if 2FA is on, a stloen password alone is useless.

this is my opinion, I'm not claiming it's absolute truth.

Three different views emerged, they all complement each other. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If I were you, I'd go this route.

Could you elaborate on that? An automated scan report is not the same as a penetration test.

Just because everyone does it doesn't mean it's right. That's all, sorry if I went on too long.

I've been dealing with this for a long time. The harder it is to reverse a decision the slower you should make it.

If I were you I'd go this route.

Absolutely. If I were to add anything: Don't rely on a single measure; go layer by layer.

Correct me if I'm wrong.