Incident Response & Digital Forensics

Incident Response Planning & Playbooks

Plans written by people who have run the incident, not the template.

The situation

We build response capability rather than response documents: an incident classification scheme tied to real notification obligations, playbooks for the scenarios that actually occur — ransomware, business email compromise, insider data theft, third-party breach, cloud account takeover.

The plan includes a decision framework covering the questions organisations always face unprepared, including whether and how to engage law enforcement and what to do about ransom demands.

What the client receives

Schedule of deliverables

01Incident response plan and severity classification model
02Scenario playbooks for the priority incident types
03Regulatory notification decision tree and pre-drafted templates
04Roles, escalation and crisis communication structure
05Evidence preservation and chain-of-custody procedure
06Third-party and law enforcement engagement protocol

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

NIST SP 800-61r3
ISO/IEC 27035
NIS2 Art. 23
DORA Art. 17–19
GDPR Art. 33–34

Incident Response & Digital ForensicsIncident Response RetainerA named team, a guaranteed response time and a contract already signed when it matters.Service detail Incident Response & Digital ForensicsCrisis Simulation & Tabletop ExercisesFail in a conference room rather than in production.Service detail

Discuss this engagement

Tell us about the scenarios that would hurt most and who would have to decide and we will set out the scope, the method and the reporting format.