Incident response plan for a 10-person company: What should it include without turning into binders of paperwork?

First thing you do: do not keep that plan on the company server. If ransomware hits, you won't be able to access your own server. Keep printed copies with the manager and tech lead, and stash another copy in an independent, external cloud folder. Also pick an out-of-band communication channel ahead of time, not company email.

We run an agency of a similar size in Munich. Last year, a client's email account got compromised. Because we hadn't written down who calls whom beforehand, we lost the first 4 hours panicking internally and asking each other questions. After that incident, we put together a one-page flowchart. It only took us 3 hours to prepare, but during a minor DNS issue later on, we got organized within 20 minutes.

On the technical side, the biggest mistake people make in a panic is pulling the server plug or immediately rebooting. That wipes the volatile memory logs in RAM, and you won't be able to tell how the attacker got in. The plan must explicitly state: 'do not shut down the machine, just pull the network cable or disable the virtual server's network adapter.'

If you operate in Germany, do not disregard the legal dimension. Your incident response plan should clearly define, as a distinct step, the 72-hour obligation to notify the relevant supervisory authority pursuant to Article 33 of GDPR, as well as the procedure for notifying data subjects if necessary. Companies frequently miss this deadline amid internal chaos.

Those audit questionnaires clients send over are generic corporate checklists. The two-page plan you write will work great internally, but an enterprise auditor might be looking for checkboxes like a 24/7 SOC. Write the plan, but when presenting it to the client, frame it clearly as an 'agile plan tailored to a 10-person organizational structure,' otherwise you'll make life unnecessarily hard for yourselves.

Edit: asked below, I wrote the answer in the second message.

we're an 8-person team and when something similar happened to us we realized no one had our lawyer's number... an emergency phone list and backup contact info for everyone is the most critical part... just title the doc Incident Response Plan, keep the content to a 2-page summary and you're good.

In the audit, is your client just asking whether a plan exists, or are they also requesting the latest test report and third-party sign-off? Some audits only want to see exercise minutes, while others require an external audit report. Have you checked the security addendum in your contract?

Don't be too hard on yourselves, no need to drown in enterprise templates. Just add a simple severity classification to your plan: Low (single user affected), Medium (service outage, but data is safe), High (data breach or critical data loss). This classification makes it crystal clear who needs to be alerted and when.

I'm in the same situation, that's why I'm asking. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Solutions that work at a small scale collapse when you grow; I learned this late. If you post the result here, it will help others too.

I agree, and I'd like to emphasize that. Most incidents start with a leaked password, not a vulnerability.

If you post the result here, it will help others too.

I have a question don't want to go off-topic though. Payment information changes are never verified through the channel they came from.

Having backups accessible on the same network and with the same identity makes them part of the target. btw correct me if I'm wrong.

Thanks a lot, I'll try it today.

i'll try it. when making a decision first look at what data you have on hand.

i'm also curious if anyone does it differently.

This thread is archived.

Here's how it went for us. Having backups accessible on the same network and with the same identity makes them part of the target.

I'm also curious if anyone does it differently.

Timely topic.

let me summarize the topic, since several diffreent answers were given but most time waste accumulates in tasks waiting for approval.

hope this helps.

Yes, that's exactly how it is with incident response plan. Taking measures without an inventory leaves doors you haven't seen open.