Incident Response Plan
1. Purpose & Scope
This Incident Response Plan (IRP) establishes procedures for detecting, responding to, and recovering from security incidents affecting ThinkKits systems and data. It ensures a consistent, timely, and compliant response to minimize impact and meet regulatory obligations.
Scope: This plan applies to all ThinkKits production systems, APIs, databases, user data, and supporting infrastructure. It covers incidents involving unauthorized access, data exposure, service disruption, malware, or any event that may compromise the confidentiality, integrity, or availability of ThinkKits services.
This IRP applies to all employees, contractors, and third-party service providers with access to ThinkKits systems or data.
2. Severity Levels
P1 Critical
Definition: Active data breach, complete service outage, or compromise of PII.
Target response time: within 1 hour (24/7 monitoring; faster where operationally possible)
Examples: Database exfiltration, auth bypass, production down
P2 High
Definition: Partial outage, potential exposure, or vulnerability being actively exploited.
Response time: 1 hour
Examples: API vulnerability under exploitation, database replication failure
P3 Medium
Definition: Non-critical vulnerability, degraded performance, failed security control.
Response time: 4 hours
Examples: XSS vulnerability found, elevated error rates, failed backup
P4 Low
Definition: Minor issue, informational finding, or policy violation.
Response time: 24 hours
Examples: Outdated dependency, misconfigured non-production resource
3. Incident Response Team
| Role | Responsible Party |
|---|---|
| Incident Commander | CTO / Founder (security@thinkkits.com) |
| Technical Lead | Lead Engineer |
| Communications Lead | CEO |
| Legal Advisor | External Counsel (on retainer) |
| External Contact | security@thinkkits.com |
4. Response Phases
Phase 1 — Detection & Triage
0–15 minutes
- Automated alerts (Sentry, UptimeRobot, Railway)
- User/researcher reports via security@thinkkits.com
- Classify severity level
- Activate response team
Phase 2 — Containment
15 min – 2 hr
- Isolate affected systems
- Revoke compromised credentials
- Enable enhanced logging
- Preserve forensic evidence
Phase 3 — Eradication
2–24 hr
- Root cause analysis
- Patch vulnerabilities
- Verify fix in staging
- Security review of related systems
Phase 4 — Recovery
24–72 hr
- Staged restoration of services
- Enhanced monitoring period
- User notification (if required)
- Stakeholder communication
Phase 5 — Post-Incident Review
72 hr – 2 weeks
- Blameless post-mortem document
- Timeline reconstruction
- Lessons learned
- Policy/procedure updates
5. 72-Hour Breach Notification
Federal and state breach notification requirements may apply to technology providers. ThinkKits does not collect, store, or process student personally identifiable information (PII) and is not subject to FERPA.
ThinkKits processes only publicly available federal education data and does not store student PII. In the event of a breach affecting user account data:
- Within 24 hours: Assess scope and begin notification preparation
- Within 48 hours: Notify affected users via email
- Within 72 hours: Notify applicable state attorneys general per state breach notification law requirements
Education-Specific State Requirements
- Illinois SOPPA (Student Online Personal Protection Act): Requires breach notification to schools and districts; specific timelines for student data
- New York Ed Law 2-d: Education Law §2-d mandates breach notification for student data; NYSED and parents must be notified
- California AB 1584: Pupil records breach notification; schools and parents must be informed
Template Notification Email Outline
- Subject line: [ThinkKits] Security Incident Notification
- Date and brief description of incident
- Types of data potentially affected
- Steps taken to contain and remediate
- Recommended user actions (e.g., password reset)
- Contact for questions: security@thinkkits.com
6. Communication Templates
P1 (Critical)
- Immediate status page update
- Direct email to all users within 1 hour
- Follow-up with root cause within 24 hours
P2 (High)
- Status page advisory within 2 hours
- Email to affected users within 4 hours
P3–P4
- Internal ticket
- Changelog entry when resolved
7. External Reporting
- Vulnerability submitter: Report per Bug Bounty program timelines
- Affected third-party vendors/partners: Notify as soon as scope is determined
- Regulatory reporting: FTC, state attorneys general, and other authorities as required by law
- Insurance carrier: Report to cyber insurance carrier per policy terms
8. Contact Information
Security & Support
Security Team: security@thinkkits.com
General Support: support@thinkkits.com
Phone: (267) 936-0332
Address: 151 Discovery Dr Ste 107, Colmar, PA 18915