Services Incident readiness
Be ready on the worst day of the year.
Incident response, business continuity and disaster recovery plans built around what actually keeps you in business, tested before you need them.
A plan is not the same as a capability
Beautifully formatted plans can fail within the first hour of a real incident, while a scrappy one-page runbook can save a company. The difference is practice and clear ownership.
- Nobody knows who makes the call in the first hour.
- Contact lists and runbooks are out of date.
- Backups exist but have never been restored.
- Legal, communications and leadership are not in the plan.
Our approach
Assess current readiness
How you would detect, decide, contain and recover today, and where that would break.
Business impact analysis
Which processes matter most, and how long you can live without them (RTO and RPO).
Plans that work
Response plans and runbooks for data breach, ransomware, business email compromise, insider threat, supply-chain compromise, cloud account takeover and denial of service.
Roles and communication
Clear decision rights, escalation paths, and communication with staff, customers, regulators and insurers.
Tabletop exercises
Realistic scenarios with your leadership and technical teams. A plan that has never been tested is a guess.
Review and improve
Post-exercise and post-incident reviews that feed back into the plan.
Business continuity and disaster recovery
Recovery strategies and tested plans for ransomware, outages, supplier failures and natural disasters, including identity and access recovery, often the hardest part of a real recovery.
Standards we align to
- NIST SP 800-61
- NIST SP 800-34
- ISO 22301
- ISO 27035
- SEC cyber disclosure
- HIPAA breach notification
- US state breach laws
- GDPR
Questions
Do you provide 24/7 incident response?
We lead and coordinate the response as your security leader and work alongside a specialist forensics firm when one is needed. We help you choose that firm in advance, so you are not searching during a crisis.
How often should we run a tabletop exercise?
At least once a year, and after any major change in your systems, team or suppliers.
Will this help with cyber insurance?
Usually, yes. Insurers increasingly ask for tested incident response and backup recovery plans.
Get ready before you need to be.
A short conversation is enough to plan your first tabletop exercise.