Security program advisory
Organize security decisions, responsibilities, and priorities.
Services
Incident response planning
Define how your organization will prepare for and coordinate a security incident.
How an engagement runs
What we’ll cover
Review contacts, decision owners, and existing incident procedures.
Identify access, evidence handling, and communication requirements.
Discuss availability and any response arrangement separately in a written agreement.
The work
What incident response planning covers
Contacts and decision owners
Who is called, who decides, and who speaks for the organization when an incident happens, written down before it is needed.
Evidence and access
What logs and systems responders will need, how evidence is preserved, and what access must be arranged in advance so an investigation is not delayed.
Communication and obligations
How staff, customers, insurers and regulators are informed, and how notification obligations identified by your legal advisers fit into the plan.
Scope
A scope you can review
Your proposal defines the systems covered, deliverables, responsibilities, timeline, and fees. Work begins after the scope and required authorization are agreed. Any ongoing coverage or response commitments are specified in the service agreement.
- Systems covered
- Deliverables
- Responsibilities
- Timeline
- Fees
After the work
Useful next steps
The aim is to help your team understand the findings and decide what to address first. Remediation assistance and retesting can be discussed as part of the engagement.
Questions
Common questions
What is an incident response retainer?
An agreement made in advance that sets out how an incident response provider will help when you have a security incident. Availability, scope and fees are defined in a written agreement, so there is no negotiation in the middle of an incident.
Does our cyber insurance already cover incident response?
Many policies include a panel of response providers and conditions on who can be used. Check your policy and broker before arranging a retainer; planning work can be aligned with your insurer's requirements.
We do not have an incident response plan. Where do we start?
With the basics: contacts, decision owners, where your important logs are, and how you would reach your insurer and legal advisers. These can be documented first and built on later.
Start a conversation
Your next step.Let’s make it clear.
Tell us about your environment and priorities. We’ll discuss the scope and outline the next steps.