Cybersecurity
Incident Response & Recovery
Decide how you will respond before you need to.
The worst time to design a response is during one
Every control eventually meets something it does not stop. What separates a bad week from an existential event is whether the organisation knows who decides, who is called, what gets disconnected, and how work continues while systems are unavailable.
Incident response planning is unglamorous preparation that pays out exactly once. We write the plan with you, make sure the technical means to execute it exist, and then help you use it if the day comes.
Scope
Preparation, response and afterwards
Before an incident we build and rehearse the plan. During one we work the technical containment, preservation and recovery steps alongside your leadership, insurer and, where relevant, legal counsel. Afterwards we help you understand what happened and close the gap that allowed it.
Response plan
Roles, decision authority, contact paths and escalation written down and kept somewhere reachable when systems are down.
Containment
Isolating affected devices and accounts quickly, using tooling that is already deployed and tested.
Preservation and investigation
Preserving logs and images before recovery destroys them, which matters for insurers and any legal process.
Recovery
Restoring from backups that have been tested, in an order that gets the business working again fastest.
Communication support
Practical help with what to tell staff, clients and partners, coordinated with your counsel.
Post-incident review
An honest account of the entry point and the remediation that follows from it.
What you get
What changes when incident response & recovery is handled well
- A plan that names people and decisions rather than describing generic phases.
- Containment measured in minutes because the tooling and access already exist.
- Evidence preserved instead of overwritten during a rushed recovery.
- A defined route back to working, tested rather than assumed.
A practical note on incident response & recovery
Cyber insurance policies often require a specific notification sequence and may require approved vendors. We work within your policy rather than around it, and we recommend confirming those requirements before an incident rather than during one.
How we deliver it
How we deliver incident response & recovery
Write the plan
Decision makers, contacts, critical systems, recovery order and the technical steps for each scenario.
Rehearse it
A tabletop exercise finds the gaps while the stakes are low: the missing phone number, the backup nobody can restore.
Keep it current
Plans age. Staff change, systems change, and the document is reviewed on the cadence set in your plan.