Incident Response — When Something Goes Wrong

A security incident is any event that may have compromised the confidentiality, integrity, or availability of your systems or customer data. Without a response plan, incidents are handled in panic — decisions are made poorly, communication is inconsistent, and the response makes things worse. The basic incident response phases: (1) Detection — you discover or are notified of a potential incident. (2) Containment — stop the bleeding. Disable compromised credentials, revoke API keys, take affected systems offline if necessary. (3) Investigation — understand what happened, when, and what data was accessed. (4) Eradication — remove the root cause (patch the vulnerability, clean up compromised systems). (5) Recovery — restore service to normal operation. (6) Post-incident review — document what happened and what you'll change. For a small SaaS, your incident response team is probably you and one or two others. Define roles in advance: who is the incident coordinator (makes decisions), who is technical (investigates and contains), who handles customer communication (drafts notifications), and who handles any legal/regulatory obligations. Knowing this before an incident saves precious time.

The Australian Privacy Act's Notifiable Data Breaches (NDB) scheme requires notification to the OAIC (Office of the Australian Information Commissioner) and affected individuals when a data breach is likely to cause serious harm. For health information (NDIS client data), the threshold for 'serious harm' is lower — more breaches will trigger the notification obligation. The 30-day clock: you have 30 days from becoming aware of a breach to notify if you conclude it meets the threshold. The assessment must be documented — even if you decide the breach doesn't require notification, document that assessment in case the OAIC or affected parties later challenge your decision. Customer notification: beyond legal obligation, notifying affected customers promptly and clearly is the right thing to do and typically the best reputation management strategy. A breach notification that comes from you, proactively, with clear explanation of what happened and what you've done to fix it, is received far better than one that comes after a customer discovers the breach themselves. Write a template breach notification letter now — not when you're in the middle of an incident. Cyber insurance: worth exploring for any SaaS handling health or personal data. Policies cover investigation costs, notification costs, legal fees, and some business interruption. Premiums for small SaaS run $1,000–$3,000/year. Consider it alongside your business insurance review.