They asked for an incident response plan — at our size, who writes it and where do we even start?

Big companies are putting these clauses in their standard contracts now to manage vendor risk. Whatever you do, don't copy-paste a template full of terms like "SOC team" or "security operations center." If a minor hiccup happens tomorrow and they ask "did you follow your procedure?", you'll be cornered.

Just grab an A4 sheet right now and put an emergency phone tree at the top. 1) Who does the person who spots the issue call first? 2) Who pulls the plug or cuts the internet? 3) Which email template goes out to the client? Put that in a Word doc, sign it off and you're good.

On the technical side, the most critical detail is log management. Definitely mention where system logs are kept and how long backups are stored in an off-network environment. If an incident happens, an external specialist investigating it will want to see at least a 30-day activity log history.

Including a 3-tier incident classification will make a great impression on the corporate side: 1) Low: A phishing email caught by one user and deleted before being opened. 2) Medium: A workstation gets infected with malware but hasn't spread to the network. 3) High: Unauthorized access to the client database or servers getting locked down.

Is the client only asking for the document itself, or did they also request extras like an incident drill report from the past year or pentest results? Have you checked the rest of the specifications carefully?

Two years ago, when we were a similar-sized automotive supplier they asked us for the same thing. We sat down and handed over a 30-page document fitting for a huge conglomerate. Three months later, an employee's PC caught malware, and we didn't notify the client. In the audit they realized we violated our own policy and fined us 50,000 TL. Keep it short and sweet, but follow it to the letter.

mate dont panic and definitely dont waste money outsourcing it. I mean u are only 15 people anyway, just make it clear who calls who and state that backups are kept offline thats plenty for enterprise clients.

These documents requested by corporate procurement units generally target the basic controls of the ISO 27001 standard. Including KVKK data breach notification obligations and an executive sign-off mechanism in your text will also ensure full legal compliance.

My perspective changed after experiencing that. Solutions that work at a small scale collapse when you grow; I learned this late.

Just leaving this note, it might be useful.

quick summary for newcomers: Just because everyone does it doesn't mean it's right.

proven by experience.

I think differently. If it's your first time, start small; scaling comes later.

Good luck with that.

Three different views emerged, they all complement each other. Security isn't absolute; it's about making attacks not worth the effort.

Hope this helps.

I agree with this. When you try to change everything at once, nothing settles.

Proven by experience.

I don't think this advice fits everyone. Everyone rushing into incident response plan gets stuck at the same point.

I'm also curious if anyone does it differently.

the discussion got scattered, let me summarize. when you try to change everything at once, nothing settles.

correct me if I'm wrong.

Exactly like that. Having backups accessible on the same network and with the same identity makes them part of the target.

When you try to change everything at once nothing settles.

I don't think this advice fits everyone. Hasty decisions become decisions you have to fix six months later.

Proven by experience.

Let me clarify the technical side. An automated scan report is not the same as a penetration test.

If you post the result here, it will help others too.