NIST SP 800-61 Rev. 3 treats incident response as part of cybersecurity risk management across the organization. We help teams turn that guidance into usable response plans, scenario-specific playbooks, and facilitated tabletop exercises—clarifying authority, escalation, communications, and recovery decisions before an incident occurs.
Deliverables are yours to keep and are written so your team can maintain them after the engagement ends.
A facilitated session where your team walks through a realistic incident, such as ransomware or a compromised email account, and makes the decisions they would make for real. It exposes gaps in roles, communication, and procedures before an actual incident does.
The people who would make decisions during an incident: IT and security, leadership, legal or compliance, communications, and often key vendors. Executive participation matters because many critical decisions in an incident are business decisions.
Contractors subject to DFARS 252.204-7012 must report cyber incidents affecting covered defense information to the DoD within 72 hours of discovery, preserve images of affected systems, and support follow-up requests. Your plan should make those steps automatic.
We discuss what is driving the need and when it is due.
You receive a scope, deliverables, timeline, and fee.
We send a document request and schedule interviews with your team.
Senior security leadership to set priorities, facilitate risk reviews, and report to executives.
Policies, standards, and procedures written around how your organization operates.
Awareness and role-based training, plus reviews of facility and access controls.
Tell us what is driving the need and when it is due. We will tell you plainly what it would take.
