MSP Incident Defensibility Index

Your work email

Director of Services / Service Delivery Lead

Our incident process lives with the people who run it

We have a written procedure from a while back

We have a written procedure that reflects how we work today

We have a written procedure that names our role, and we've walked through it in the last year

We work out our role around the specifics of the incident

We log recommendations per client with the date and the client's response

We make recommendations through email and meetings

We put the major recommendations in writing and handle the rest in conversation

Recommendations move through the relationship as they come up

Our monitoring shows up in how we respond

We report on monitoring activity in aggregate across the book

We could pull the evidence together if a client asked

Clients get reports, and the timing follows the client or the month

Each client gets a recurring report showing what we monitored, what we caught, and what we did about it

We move fast on changes and keep the overhead light

Security-relevant changes go through a process with recorded approval and a rollback path

Big changes are documented; routine ones move through ticketing

We document changes and handle approval and review as we go

The team knows the principles and applies them from experience

We'd take direction from the IR firm on what to preserve

We have a written sequence covering imaging, log preservation, chain of custody, and what not to touch

After an incident we fill out a standard template (timeline, root cause, actions, client comms)

We move on to the next thing once the incident is resolved

We have a template and use it on the incidents that warrant it

We have an IR firm on retainer with a defined response time

There's a firm we'd call first because we know them

We'd use whoever the client's insurance carrier brings in

Whoever holds the senior on-call role takes it

It depends on who's closest to the client and available when it hits

The owner or a senior person steps in and runs it

A specific person leads, with a named backup if they're unavailable

We last put it through its paces a while back

We tested it for real in an incident this past year

It's written down and we run incidents as they come