WiBiz Incident Response Plan

Document: WiBiz_Incident_Response_Plan_v1.0
Owner: Digital Benefits Pte Ltd
Classification: Internal -- Confidential
Version: v1.0
Effective Date: 15 April 2026
Review Cycle: Annual (next review: April 2027)

1. Incident Classification

Escalation rule: Any incident involving client personal data, healthcare data, or payment data is automatically P1 until downgraded by the Incident Commander.

2. Incident Response Team

Until a dedicated Security Lead is appointed, the CEO acts as Incident Commander for P1/P2 incidents.

3. Response Phases

Phase 1: Detection

• Monitor alerts from hosting providers (Vercel, cloud CRM platform), payment processors (Stripe, Razorpay), and AI service providers (Anthropic, ElevenLabs).
• Team members report suspected incidents to the Incident Commander immediately via the designated internal channel (WhatsApp group or Discord).
• Log the initial report: who detected it, when, what was observed.

Phase 2: Containment

• Short-term (first 30 minutes for P1): Isolate affected systems. Revoke compromised credentials. Disable affected integrations or API keys. If a client sub-account is compromised, disable its automations immediately.
• Long-term: Implement temporary fixes to prevent spread while preserving evidence. Do not wipe logs or redeploy until evidence is preserved.

Phase 3: Eradication

• Identify and remove the root cause (malicious code, misconfiguration, compromised account).
• Rotate all credentials that may have been exposed: API keys, database passwords, OAuth tokens, service accounts.
• Patch the vulnerability or close the attack vector.

Phase 4: Recovery

• Restore systems from verified clean backups if needed.
• Redeploy affected services with fixes applied.
• Monitor closely for 48 hours post-recovery for recurrence.
• Confirm with affected clients that service is restored.

Phase 5: Post-Incident Review

• Conduct within 5 business days of incident closure.
• Use the Post-Incident Review Template (Section 6 below).
• Document lessons learned and assign remediation actions with owners and deadlines.

4. Communication Plan

Rule: No external communication goes out without CEO approval. Draft all client and regulatory notifications before sending.

5. Evidence Preservation

When an incident is detected:

1. Do not restart, redeploy, or wipe any affected system until evidence is secured.
2. Export and preserve: server logs, application logs, access logs, API call records, database query logs.
3. Screenshot any anomalous dashboard states or error messages.
4. Record the chain of custody: who accessed what evidence and when.
5. Store all evidence in a dedicated incident folder: WiBiz OS/05 Operations/Incidents/[YYYY-MM-DD]-[short-description]/
6. Retain incident evidence for a minimum of 3 years.

6. Post-Incident Review Template

INCIDENT ID:        [INC-YYYY-MM-DD-001]
PRIORITY:           [P1/P2/P3/P4]
INCIDENT COMMANDER: [Name]
DATE OF INCIDENT:   [YYYY-MM-DD]
DATE OF REVIEW:     [YYYY-MM-DD]

1. WHAT HAPPENED
   [Plain-language summary of the incident]

2. TIMELINE
   [Chronological list: detection time, containment actions, resolution, closure]

3. ROOT CAUSE
   [Technical root cause and contributing factors]

4. IMPACT
   - Systems affected:
   - Clients affected:
   - Data affected (type and volume):
   - Duration of impact:

5. WHAT WENT WELL
   [Actions that worked effectively during response]

6. WHAT NEEDS IMPROVEMENT
   [Gaps in detection, response, or communication]

7. REMEDIATION ACTIONS
   | Action | Owner | Deadline | Status |
   |--------|-------|----------|--------|

8. LESSONS LEARNED
   [Specific changes to prevent recurrence]

7. Key Contact List

Action item: Fill all [FILL] entries within 30 days of policy adoption.

8. Annual Tabletop Exercise

• Conduct one tabletop exercise per calendar year simulating a P1 incident scenario.
• Rotate scenarios annually: data breach, ransomware, cloud provider outage, insider threat.
• All Incident Response Team members must participate.
• Document the exercise, findings, and any plan updates in the Incidents folder.
• First exercise deadline: Q3 2026.

End of document. Next review: April 2027.