Be ready on the worst day of the year.
An incident response capability that actually works when the alarms go off, because you built it, trained on it, and tested it before the real thing.
A written incident response plan is not the same as an incident response capability. We have seen beautifully formatted plans fail within the first hour of a real incident. We have also seen scrappy one-page runbooks save companies. The difference is practice, clarity, and leadership. That is what we help you build.
Why incident response plans fail in practice
- Nobody has read the plan since it was written.
- Roles are assigned to job titles that no longer exist.
- The escalation tree stops working outside office hours.
- Communication templates are not ready when they are most needed.
- No one has practised making decisions under pressure.
We fix all of that, from the plan document to the rehearsed muscle memory of the people who will execute it.
Our approach
Assess current readiness
We start by evaluating what you already have: detection capability, existing runbooks, escalation procedures, vendor relationships, legal and communication preparation, and the state of your logging and forensic readiness. You get an honest picture of where you are strong and where you are exposed.
Work with all the right stakeholders
Incident response is not just an IT activity. We bring in executive leadership, legal counsel, HR, communications, and key business owners, so the plan reflects how decisions actually get made under pressure.
Build a response plan that works
Your plan covers the scenarios that matter most:
- Data breach and exfiltration
- Ransomware and destructive malware
- Business email compromise and financial fraud
- Insider threats and credential misuse
- Third-party and supply-chain compromise
- Cloud account takeover
- Denial of service
Define clear roles and responsibilities
Every plan we build names an incident commander, a technical lead, a legal lead, a communications lead, and an executive sponsor. Backups are named for every role. Everyone knows their job before the incident begins.
Communication protocols
Pre-written templates for internal communications, customer notifications, regulator disclosures, media statements, and board updates. You do not want to be writing this in the first hour of a crisis.
Tabletop exercises and simulations
We run realistic, role-based exercises that put the plan under pressure. These are the single most valuable thing most organisations do to improve their readiness. We make them focused, challenging, and useful.
Post-incident review and improvement
Every exercise (and every real incident) produces lessons. We help you capture them, turn them into plan updates, and track the improvements over time.
Standards we align to
- NIST SP 800-61 Incident Handling Guide
- ISO/IEC 27035 Information Security Incident Management
- Essential Eight and ISM (where Australian Government alignment matters)
- APRA CPS 234 incident notification requirements
- Notifiable Data Breaches scheme under the Australian Privacy Act
- GDPR, CCPA, HIPAA, and PCI DSS breach notification obligations
Get ready before you need to be
If you want to know whether your incident response capability would actually hold up in a real event, book an intro call. We will tell you what we would test first.