Bespoke Incident Response Plan
A written plan for one company at one location, built from your answers to a questionnaire. It is meant to be read by an owner, not an engineer.
for one company at one location. Extra locations are quoted separately.
What is in it
- A written plan for your company, built from the questionnaire you fill out.
- One round of revisions after you read the draft.
- Plain language, short steps, and no jargon you have to look up in the middle of a problem.
The three situations
- A ransom note, or files that were renamed. Someone opens a folder and the files have odd new names, or a note asks for payment.
- A mailbox acting on its own. Mail went out that nobody sent, a forwarding rule appeared that nobody made, or an email asks you to pay a vendor at a new bank account.
- A lost or stolen laptop. A work laptop is gone from a car, a coffee shop, or the office.
What each part spells out
- Roles. Who on your team does what, and who is the backup when that person is out.
- Who may decide. Who has the authority to cut off email, hold a vendor payment, or take a laptop off the network.
- Your outside parties. The people you already work with, written in one place: your IT person or managed service provider, your bank, your insurer, and your lawyer, with when to call each one.
- Reporting. Reporting to the FBI Internet Crime Complaint Center (IC3) is listed as an option for you to choose. Sitalingi Cybersecurity does not file it for you.
- What not to do. Do not pay anyone because the document mentions payment. Do not wipe a machine just because a paragraph said so. Do not negotiate from a script. The plan helps you pause, call the right people, and decide.
What is not included
- Logging into your computers, email, or any other system.
- Forensics.
- Legal advice. That comes from your lawyer.
- Insurance advice. That comes from your insurer or agent.
- A tabletop exercise.
- A second location. Extra locations are quoted.
- Hands-on help during an incident. That is done remotely and billed by the hour through the retainer, or as emergency help without one.
The plan is not written to satisfy a particular law, insurer requirement, or framework. You decide how to use it.
The questionnaire, in plain words
After your request is accepted, you get a questionnaire. It asks about your people, the services you rely on, how you pay vendors, and who you already call for help. It does not ask for passwords, and you should never put one in your answers.
This website does not store questionnaire answers. The questionnaire is sent separately after you ask for the plan.
Want the step by step? Read how it works.
Questions
Who is the plan for?
Small businesses anywhere, usually about 5 to 50 people, where the owner does not have a security team and relies on an outside IT person or provider.
What does the plan include?
A written plan for one company at one location, built from your questionnaire, covering the three situations above, plus one round of revisions. It does not include logging in, forensics, legal or insurance advice, a tabletop exercise, or a second location.
Do you log in to our computers or email?
Not for the plan. The plan is written from your answers, and the questionnaire never asks for a password. Hands-on work on your systems is done remotely, and only under the retainer or as hourly emergency help, after a written agreement and your authorization as the system owner.
Do we need a retainer?
No. The plan stands on its own. The retainer is optional: you buy as many hours as you want at an hour for hands-on incident response help, advice, and plan updates.