Incident readiness your team can already run

An incident response plan names who is called, who is allowed to decide, and what happens in the first hour. The plan is specific to the systems you already run. It is not a template with your logo pasted on the cover.

A tabletop exercise runs one scenario with the people who would be in the room. The point is the decision they reach, and the record of where they stalled. We need those people present. An exercise held without them is a rehearsal of a guess.

Incident response playbooks are the sequences for incidents you can already name: a lost laptop, a vendor account, a payment system, a customer-data export. The plan says who decides. The playbook says what that person does next.

A ransomware readiness assessment asks whether access can be revoked, whether a restore has ever been completed, and who is allowed to decide about payment. We do not contact an attacker, and we do not tell you to pay.

Breach readiness names who would speak to customers, to counsel, and to an insurer, and which facts a notice would need. We do not give legal advice, and we do not decide whether a notice is required.

Backup and recovery testing is a restore someone can point at, with an owner and a time. A backup report that says success, and has never been restored, is not a test.

We ask these of one incident a company can name. A lost laptop. A vendor account. A payment system. A customer-data export.

1. Who is called first, and who may decide.
2. Who can disable an account, a key, and a vendor session, and how long that takes on a Friday.
3. Where the list of systems that hold customer data lives, and when it was last checked against what is running.
4. Whether offboarding is current enough that the access list can be trusted.
5. Who speaks to customers, and who speaks to the insurer or the auditor, and whether they share the facts.
6. Whether the week after can show what was done. For SOC 2 or PCI, the evidence has to match the path taken.

If two questions have no name, the gap is owners. A policy nobody has walked is not the finding.

We work around your normal operations, and we'll need access to the right areas and the right people while we do.

Before the work starts you receive a written scope. You can decline it. Once you approve it, we need the plan if one exists, the systems the incident would cross, and time with the people who would be called. A blank note is enough to start the conversation. It is not enough to finish the plan.

We do not ask you to stop operations for a general tour. We do ask the right people to sit with us while we read the record and walk one path. If those people are not available, we say so and we wait, rather than inventing owners.

We run the questions on one system you name. We'll need access to that system and the right people. We record what held, what slipped, and what changed.

A named owner and a revoke step someone has used is the result. An argument about who decides is the finding. Recon Assessment, starting at $15,000 plus expenses. Four days on site with your team, then a written report.