Incident response planning.

What we build

Incident response plan.

Custom to your environment, your systems, and the threat model that applies to your business. Not a generic template. The plan maps to your actual infrastructure, your team structure, and the incident types most likely to hit your industry. It covers detection, containment, eradication, recovery, and post-incident review with clear criteria for escalation at each stage. The plan also addresses your cyber insurance notification requirements, because missing a carrier deadline during an active incident adds a financial problem on top of a technical one.

Role definitions.

A clear responsibility matrix that defines who leads incident response, who authorizes system isolation, who communicates with customers, who contacts legal counsel, and who interfaces with law enforcement if needed. Primary and backup contacts for each role. Documented decision authority for time-sensitive actions like taking a production system offline. During an active incident, ambiguity about who decides what costs hours.

Communication protocols.

Separate plans for internal audiences and external audiences. Each includes notification triggers, message templates, approval chains, and timelines. If your business is subject to breach notification requirements at the state or federal level, we map the specific disclosure obligations and deadlines into the plan so your leadership knows exactly what's required and when.

Technical runbooks.

Step-by-step containment and recovery procedures for your most likely scenarios. Ransomware including encryption and lateral movement containment. Business email compromise with wire fraud. Data exfiltration through compromised accounts or malware. Supply chain compromise through trusted vendor connections. Each runbook includes the specific tools and commands for your environment, evidence preservation procedures for potential forensic investigation, and recovery verification steps so you know the threat is actually gone before you restore normal operations.

Tabletop exercises.

Simulated incidents run live with your team. We present a realistic scenario, introduce complications as the exercise progresses the way real incidents escalate, and observe how your team responds. After the exercise we debrief. What worked, where the plan broke down, where roles were unclear, and where decisions were made that the plan didn't anticipate. The findings feed back into plan revisions so each iteration makes it stronger. Most organizations discover more gaps in a two-hour tabletop than in months of theoretical review.