Incident Response & Digital Forensics
When an incident happens, the first hours decide the cost. We prepare your organization in advance, respond quickly when called and document every step for insurers, counsel and regulators.
Scope
What is included
A prepared team on call for the worst day, and a plan to make it shorter.
Incident response retainer
Agreed response targets and pre-arranged access, so no time is lost on paperwork.
Containment and eradication
Isolating affected systems, removing attacker access and closing the entry point.
Forensic investigation
Evidence collected and preserved to establish what happened and what was reached.
Ransomware recovery
Coordinated restoration alongside your backup and infrastructure teams.
Notification support
Facts and timelines prepared for counsel, regulators, partners and customers.
Post-incident review
A written account of root cause and the changes that will prevent a repeat.
Method
How it works
Three stages, each with a written output, so you always know what has been done and what comes next.
- 01
Prepare
We write the plan, define roles and rehearse it with your team.
- 02
Respond
Responders contain the incident, investigate and keep leadership informed.
- 03
Recover and learn
Systems are restored, findings documented and improvements tracked.
Standards and technology
We think we have an incident right now. What should we do?
Call 916-288-5452. Do not power off affected systems or delete anything; disconnect them from the network if you can do so safely, and note what you observed and when.
Do you work with our cyber insurer and counsel?
Yes. We coordinate with your insurer and work under the direction of legal counsel where privilege matters.
Do we need a retainer?
No, but it helps. A retainer means contracts, contacts and access are already in place, which saves hours when they count most.
Related
Often taken together
13 / 14
DevSecOps
Ship software quickly, with security checks built into the pipeline.
14 / 14
AML Monitoring & Sanctions
Monitoring and screening systems that satisfy BSA/AML expectations and spare your analysts the noise.
01 / 14
Managed Cybersecurity
A security operations team that watches, investigates and responds around the clock.