MSRXMSRXSecurity
For small businesses

Security paperwork, done

Fill in a few fields and get the documents most small businesses never write: an incident plan, a security policy, a supplier questionnaire and a DPDP privacy notice. Copy them out and make them yours.

Who leads, what to do in the first hour, who to tell, and when CERT-In and the DPDP duties apply.

INCIDENT RESPONSE PLAN: [Organisation name]

1. WHO LEADS
  Incident lead: [name]  [phone]
  Deputy:        [name]  [phone]
  IT / hosting:  [provider and 24-hour contact]
  Anyone who notices something odd tells the incident lead at once, by phone, then in writing.

2. WHAT WE PROTECT
  Systems and data that matter most: [website, e-mail, accounting, customer records, ...]

3. HOW BAD IS IT
  Critical: money is leaving, files are encrypted, an attacker is active, or customer data is exposed.
  High: one account or device is taken over, or a site is defaced, with no sign of spread.
  Low: a blocked attack, a phishing e-mail nobody clicked.

4. THE FIRST HOUR
  a. Write down the time you noticed it and what you saw. Keep a running log from now.
  b. Contain it: disconnect the affected device from the network, or take the site offline. Do not switch the device off if files may be encrypted.
  c. Change passwords and revoke sessions and keys for affected accounts, from a clean device.
  d. If money has moved: call the bank's fraud line and 1930 immediately.
  e. Keep evidence: do not wipe or reinstall until a copy of logs and affected files is taken.

5. WHO WE TELL
  Bank and card providers, if money or cards are involved.
  Our hosting, e-mail and software providers, so they can help and preserve logs.
  CERT-In, within 6 hours of noticing, for the incident types listed in its directions of 28 April 2022. Use the breach planner on MSRX Security (/breach) to see the duties and a draft report.
  The Data Protection Board of India and the people affected, as the DPDP Rules require. The breach planner shows the current position.
  Cyber crime complaint at cybercrime.gov.in.

6. RECOVER
  Restore from a backup taken before the incident, then apply all updates before going live again.
  Rebuild rather than clean where we can. Rotate every secret that touched the affected system.

7. AFTER
  Within one week, hold a short review: what happened, how we found out, what slowed us down, what changes.
  Update this plan. Test it once a year by walking through a pretend incident.

Contact numbers to keep on paper: Cyber crime helpline 1930. CERT-In incident@cert-in.org.in, 1800-11-4949.

What you type stays in this page. Nothing is saved or sent. These are starting templates, not legal advice: have a lawyer review anything you publish or rely on. MSRX Security accepts zero liability for how you use them, as set out in the terms.

Next: the self-assessment checklists, the breach reporting planner and the staff quiz.