Incident readiness & response

Make the first decisions before the incident.

Specialist delivery and availability are confirmed during scoping.

THE RIGHT STARTING POINT

For leadership and IT teams preparing for disruption. Incident assistance, availability, activation, and response targets require an agreed engagement.

A clear scope. A useful outcome.

Build a response plan your team can use under pressure. Start with a readiness review and a realistic tabletop exercise, then agree how investigation and recovery support would be activated.

The final scope, deliverables, and timing are agreed for your engagement.

What we cover

• Incident plans and decision authority
• Ransomware and account-compromise exercises
• Evidence preservation and investigation planning
• Containment, recovery, and reporting coordination

What you take away

• Incident playbook and contact tree
• Tabletop findings and action register
• Evidence collection requirements
• Response engagement and escalation scope

How to engage

Readiness project, tabletop exercise, or a separately scoped response arrangement.

What progress looks like

Exercise actions closed, evidence sources available, and escalation decisions successfully rehearsed.

Before the engagement.

Agree the systems and business processes in scope, the authorisation required, the people involved and how the findings will be used. Timelines, deliverables, exclusions and any verification work should be confirmed directly.