Incident-Response Support When Something Has Already Gone Wrong

Yes. Incident-response support can be engaged directly once an incident is under way, without a pre-existing retainer, though a business that already has a plan and named contacts in place is able to move into containment faster than one starting cold.

Response depends on how the support is arranged and how serious the incident is — a retainer with an agreed escalation path moves faster into action than a one-off engagement set up after the fact. We do not promise a fixed response time up front; how urgency is handled is set out clearly during scoping.

Whether the arrangement is an ongoing retainer or a one-off engagement, and the scale and severity of what is being handled. A single suspicious login investigated and closed costs far less than a multi-system incident needing containment, investigation and customer communication together.

No. A plan makes any future response faster and clearer, but support can be provided during an active incident even where no plan exists yet — building one afterwards is often part of what follows.

We help draft what needs to be communicated and work out what was actually affected, so your business can meet its own notification obligations with an accurate account. The decision of what to say and to whom remains yours.

You do. Everything produced during an incident — findings, timelines, communication drafts — belongs to your business and stays available to you afterwards, including for any regulator or insurer that later asks for it.

For preparation, a list of your key systems and the people who should be contacted during an incident. For an active incident, immediate access to the affected systems, a clear point of contact on your side, and whatever you already know about what triggered the concern.