Incident Response Policy
Sooner or later something will go wrong: a lost laptop, a clicked phishing link, a leaked key or a hacked account. What matters most is how quickly we notice and respond. This policy sets out what to do.
Document
Policy number
TSS-IT-05
Version
1.0
Effective from
1 September 2026
Next review
March 2027
Owner
IT Team
Approved by
Board of Directors
Applies to
Every employee, trainee and intern, and every system and piece of data we are responsible for, including client systems we manage.
Issued by
Thakur Systems & Structures Private Limited, CIN U62011PN2026PTC254650
Related policies
Information Security Policy (TSS-IT-02), Data Privacy and Management Policy (TSS-IT-04), Disaster Recovery and Business Continuity Policy (TSS-IT-08), Whistleblower Policy (TSS-HR-06)
1. WHAT COUNTS AS AN INCIDENT
Any event that threatens the confidentiality, accuracy or availability of our information or systems, or our clients’. For example:
a lost or stolen laptop or phone;
clicking a phishing link, or entering your password on a fake page;
malware or ransomware;
a password, API key or other secret being exposed, for example by being pushed to a public repository;
someone accessing systems or data they should not;
personal data sent to the wrong person;
a client system or one of our own services going down unexpectedly;
sign-ins you do not recognise, or MFA prompts you did not start.
If you are not sure whether something is an incident, report it anyway.
2. REPORT IT IMMEDIATELY
Tell the IT team straight away, by phone or message, then follow up in writing. Do not wait until you are sure, and do not wait until the next day.
Say what you know: what happened, when, which systems or data are involved, and what you have done so far.
Disconnect, do not destroy. If a device is involved and it is safe to do so, disconnect it from the network by turning off Wi-Fi. Do not switch it off, reset it or delete anything, because that can destroy evidence.
Do not investigate alone. Do not try to fix things yourself, and never try to “hack back”.
No blame for reporting. You will not be blamed for reporting a mistake quickly. Delays and cover-ups are what turn a small problem into a big one.
Outside working hours. If you lose a device, or notice something serious such as a leaked secret, outside working hours, call the Director on the emergency number shared at induction. It takes a couple of minutes and does not count as working: the Director takes it from there, and you can switch off.
3. SEVERITY LEVELS
| LEVEL | EXAMPLES | HOW FAST WE RESPOND |
|---|---|---|
| Critical | Ransomware; a confirmed breach of client or personal data; a client’s production system down; an attacker inside our systems | Immediately. Directors are told within one hour. |
| High | A lost or stolen device; a leaked password or secret; malware on one device; a compromised account | Within one hour |
| Medium | A phishing link clicked but no details entered; suspicious activity with no confirmed impact | The same working day |
| Low | Spam, blocked attacks, minor policy slips | Within three working days |
4. WHO DOES WHAT
Incident lead (IT team). Runs the response: confirms what happened, sets the severity, coordinates the actions and keeps the incident log.
A Director. Makes decisions about business impact, client communication and legal notifications, and about bringing in outside help such as forensic experts or lawyers.
CERT-In Point of Contact. A Director named by the Board as TSS’s Point of Contact with CERT-In, as the CERT-In directions require.
The HR team. Involved where employees are affected, and for any disciplinary follow-up.
Everyone. Reports incidents, keeps evidence as it is, cooperates, and keeps the incident confidential.
5. THE RESPONSE, STEP BY STEP
- Report. Someone notices something and reports it.
- Assess. The incident lead confirms what happened and sets the severity.
- Contain. Stop it spreading: disable accounts, revoke keys and tokens, isolate devices, block addresses, and lock and wipe a lost device.
- Preserve evidence. Keep logs, screenshots, emails and affected devices as they are.
- Remove the cause. Get rid of the malware, the attacker’s access, or the weak code or setting.
- Recover. Restore systems and data from clean backups, reset credentials, and watch closely in case the problem returns.
- Notify. Tell the people who must be told (section 6).
- Learn. Review what happened and fix the underlying problem (section 7).
6. WHO WE MUST TELL, AND HOW FAST
| WHO | WHEN | WHO DOES IT |
|---|---|---|
| CERT-In | Within six hours of noticing a reportable cyber incident, such as a compromise of systems, a data breach, ransomware, or an attack on servers or cloud systems. Reports go to incident@cert-in.org.in in CERT-In’s format. | The IT team, copying the CERT-In Point of Contact; no need to wait for approval |
| Data Protection Board of India | For a personal data breach: without delay, with a detailed report within 72 hours of becoming aware of it (a legal requirement from 14 May 2027) | A Director |
| Affected people | Without delay, in plain language: what happened, the likely effects, what we are doing, and what they can do to protect themselves. For client data, the client decides who to tell, and we help. | A Director, with the IT team |
| Clients | As soon as possible, and within any time limit in their contract | A Director |
| WHO | WHEN | WHO DOES IT |
|---|---|---|
| Police | For theft, fraud, extortion or any other crime | A Director, or the person affected |
7. AFTER THE INCIDENT
Review. Every High or Critical incident gets a short written review within five working days of being closed: what happened, the timeline, the root cause, what worked, what did not, and the actions that will stop it happening again, each with an owner and a date.
Blameless. Reviews are about fixing systems and processes, not punishing people for honest mistakes. Deliberate or reckless breaches are dealt with separately under the Performance Management and Discipline Policy.
Records. The IT team keeps a log of all incidents, including Low ones, for at least three years.
8. PRACTICE
At least once a year, we run a short practice exercise that walks through a realistic scenario, such as a lost laptop holding client code or a leaked cloud key.
9. QUICK GUIDE TO COMMON INCIDENTS
Lost or stolen device. Tell the IT team immediately. They will lock and wipe it. For theft, file a police complaint and send a copy to the IT team. Your sign-ins will be reset.
Clicked a phishing link. Turn off Wi-Fi and tell the IT team. If you entered a password, tell the IT team which one, so that they can reset it straight away.
Secret pushed to Git. Tell the IT team, revoke and replace the secret immediately, and then clean the repository history.
Email or message sent to the wrong person. Ask them to delete it and confirm that they have, and tell the IT team the same day.
MFA prompt you did not start. Deny it, tell the IT team, and change your password.