Cybersecurity
Incident response planning
An incident response plan is useful if people know where it is and can follow it under stress. We write short, role-based documents and test them, instead of producing a binder nobody opens.
The problem this service solves
Most existing plans share the same weaknesses. They describe the ideal process without naming a person. They list contacts that are out of date. They cover every phase in general terms and skip the decisions that matter: who may isolate a production system, who talks to customers, when to call law enforcement or the insurer.
NIST SP 800-61 Revision 3, published in 2025, ties incident response into broader risk management and the Cybersecurity Framework 2.0. We use it as a reference structure and fit it to how your organization actually works.
What is in scope
-
Plan structure
Purpose, scope, roles and responsibilities, severity definitions, decision authority and escalation.
-
Contacts and communication
Internal and external contacts, out-of-band communication, and customer and regulator communication principles.
-
Evidence handling
What to preserve, who collects it and how, to support legal and insurance needs.
-
Scenario playbooks
Ransomware, business email compromise, cloud account compromise, data exposure, insider issue and third-party breach.
-
Integration
Link to business continuity, disaster recovery, legal and communications plans.
-
Exercises and maintenance
A test schedule and a process for updating after incidents and changes.
How the work runs
Understand
See how you really respond.
-
1
Interviews and document review
Speak with security, IT, legal, communications and business leaders.
-
2
Past incident review
Learn from what happened last time.
Draft
Write for the reader at 2 a.m.
-
3
Plan and playbooks
Concise documents, with checklists and decision points.
-
4
Review
Walk through with the people named in them.
Test
Practice.
-
5
Tabletop
Run at least one scenario to find gaps.
-
6
Revise
Update and set a maintenance cadence.
What you receive
- Incident response plan
- Severity matrix and escalation chart
- Scenario playbooks
- Contact and decision-authority sheet
- Tabletop report
- Maintenance schedule
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Existing plans and contact lists
- Access to legal, communications and IT leadership for interviews
- Information on cyber insurance and customer obligations
What this service is not
- Legal advice on breach notification obligations
- A plan that replaces judgment during a real incident
What changes afterwards
- Everyone knows their role
- Decisions have owners
- The plan has been tested once already
Questions people ask
How long should an incident response plan be?
Short. The plan itself should be readable in minutes. Detail lives in playbooks and checklists that people use during specific incident types.
What changed in NIST SP 800-61 Revision 3?
It was released in 2025, replaced Revision 2, and aligns incident response with the NIST Cybersecurity Framework 2.0 functions, treating response as part of risk management across the whole lifecycle rather than as a separate phase model.
Related
-
Tabletop exercises
Facilitated discussions where executives and technical teams work through a realistic incident, find gaps and agree changes.
-
Digital forensics and incident response
Investigate suspected intrusions: preserve evidence, determine scope, support containment and recovery, and document what happened.
-
NIST CSF 2.0 assessment
Assess current and target maturity across the six functions of NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response