They told us «You need information security» — where do we start with a 10-person company?

Disk encryption should be your first step. Turn on native OS encryption on every laptop in the office. If an employee leaves a device behind at a cafe, all contracts and files on it stay encrypted. Also, restrict USB drive access via group policies—it costs nothing and cuts off half of all data leak vectors right away.

Go through the client's questionnaire carefully. Enterprises usually blast the exact same boilerplate security survey to everyone. Most items can be waived or relaxed for small vendors. Before you blow that 100,000 rubles ask their procurement contact which controls are hard requirements versus nice-to-haves.

Ran into the exact same issue last year with our 12-person team. Paid an outside security consultant 70,000 rubles to put together a basic access matrix, roll out 2FA, and write up a one-page employee security guideline. Once the enterprise client saw the policy doc and screenshots of everything implemented, they signed off immediately.

First thing Monday morning, roll out a password manager. Stop employees from logging into shared dashboards with simple passwords or credentials saved directly in their browsers. Put a rule in place requiring complex passwords and quarterly rotations.

Is your client a public institution or private sector? If you'll be connecting directly via API to a private database containing personal data, could they be legally mandated to require locally licensed security software or specific certifications?

Don't let it intimidate you at all. When they first brought it up to us we thought we'd need hundreds of thousands of rubles worth of servers and hardware. It's actually way more about office discipline than technical gear. Simply making sure everyone uses their own account and never leaves an unlocked screen unattended will shield you from a ton of risks.

don't leave a single email account without 2fa and the client's real fear is your employee geting hacked and them using that email to launch a phishing attack on their internal network. btw lock that down and the rest is smooth sailing.

Information security requirements from corporate firms typically stem from third-party risk management procedures. The information security policy you draft must clearly outline how data is processed, where it is stored, who has access to it, and the procedures governing data destruction.

Let me speak from the other side; I'm on the supplier side. Just because everyone does it doesn't mean it's right.

Processes without records never improve, because you don't know what to fix. Good luck with that.

The answer above hits the nail on the head. Hasty decisions become decisions you have to fix six months later.

Proven by experience.

Exactly, and not many people know this. The real issue isn't the number, but what it's based on.

If you don't write this down from the start, it leads to arguments later. I'm also curious if anyone does it differently.

I went through the same thing. Forgotten test environments are more often the entry point than live systems.

If you have questions write them; I'll answer as best I can.

Let me share my experience. Mistakes made on the company information security side are usually reversible but expensive.

If I were you, I'd go this route.

we've heard this a lot but it never happened like that for us but honestly everyone ruhsing into company information security gets stuck at the same point.

if you post the resullt here it will help others too.

Thanks for posting. The answer varies greatly by industry; there is no one-size-fits-all rule.

Of course it varies if your situation is different.

i'm in the same situation that's why I'm asking. the answer varies greatly by industry; there is no one-size-fits-all rule.

proven by experience.

Let's separate the concepts, they're getting mixed up. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Correct me if I'm wrong.

We need to make a distinction here. Payment information changes are never verified through the channel they came from.

Good luck with that.