A structured response: intake, containment, recovery, and review
We help you coordinate technical response and recovery with clear roles, a written timeline, and decision logs. Scope, access, and communications are established first so work stays controlled.
We provide engineering support and coordination; exact response times and availability depend on your agreement and contact path. We do not guarantee that incidents will be prevented or that impacts will be eliminated.
Incident intake: what we ask first
A good intake prevents wasted time. We establish who is impacted, what changed, and what access is approved.
- What is affected: systems, users, locations
- When it started and what changed recently
- Known indicators: alerts, logs, tickets, screenshots
- Approved access and decision maker contacts
What to prepare
If you have these ready, we can move faster during triage and containment.
- Admin access path (SSO/MFA) and break glass accounts
- Network diagram or cloud account overview
- Backup locations and last known good restore point
- Security tools in use and log retention window
- Change window rules and approval contacts
How an incident typically runs
We keep a written timeline and decision log so technical actions and business communications remain aligned.
Triage
Confirm scope and severity, validate signals, and prioritize actions.
Contain
Reduce impact by isolating hosts, blocking indicators, or rolling back changes.
Investigate
Collect evidence within approved access and build a working hypothesis.
Recover
Restore services using runbooks and backups, validate critical business functions, and monitor stability.
Review
Publish a summary, identify root causes and gaps, and update controls and documentation.
Severity and communication matrix
Severity definitions are agreed with you. This table shows an example approach for communications and actions.
| Severity | Typical examples | Communications | Typical actions |
|---|---|---|---|
| S1 | Critical outage, confirmed ransomware, active data exposure | War room, defined update cadence, exec stakeholder updates | Contain, protect evidence, restore core services, validate access |
| S2 | Degraded service, suspicious access, limited blast radius | Incident channel, periodic updates to owners | Triage, isolate affected components, patch or roll back changes |
| S3 | Low impact alerts, investigation needed, no service interruption | Ticketed tracking, summary updates | Collect evidence, confirm true/false positive, tune detections |
Deliverables you can keep
We capture actions and decisions and provide a post-incident package aligned to your scope.
Incident timeline
A written timeline of events, actions, and decisions.
Evidence notes
What we observed within approved access and retention windows.
Containment plan
Steps taken and follow ups to reduce recurrence risk.
Recovery checklist
Validated restore steps and verification checks for critical functions.
Lessons learned
Root cause summary, gaps, and prioritized next steps.
Runbook updates
Updated procedures and ownership notes based on findings.
Ways to engage
Choose a model that matches your risk profile. Exact inclusions and hours are defined in the agreement.
On-demand incident support
Support during an active incident within the agreed scope and access.
Readiness program
Playbooks, restore tests, and tabletop exercises to reduce chaos during incidents.
Commonly included
- Incident coordination and status updates
- Containment and recovery steps within approved access
- Post-incident report and prioritized recommendations
- Playbook and runbook improvements
Commonly excluded
- Legal advice, insurance claims handling, or PR services
- Forensics beyond approved tooling or retention without prior agreement
- Guarantees of recovery times or outcomes
- Work on systems not listed in the agreed scope
Exact inclusions depend on access, vendor support, and the approved scope. We document actions and decisions during the engagement.
Related services
Incident response is stronger when monitoring, backup, and operations are aligned.
Start with intake and scope
Tell us what happened, what is impacted, and what access is approved. We will propose a controlled response plan and communications cadence.