Incident Response and Digital Forensics
Incident Response Readiness Assessment
Before an incident occurs, we assess whether all response requirements are in place. You address gaps now, not during an incident.
What it is
A readiness assessment tests if your response plan would function in a real incident. We evaluate the plan against the actual state of your systems, not just documentation. For example, we verify how many days of logs are actually available on a server. We use NIST SP 800-61 Rev. 3 and the incident management controls in ISO/IEC 27001:2022 Annex A as benchmarks.
Scope
- Response plan, roles and who decides to isolate a system
- Scope of log sources and log retention period
- Servers and workstations not covered by EDR
- Whether backups are protected by separate credentials and when the last restore was performed
- Fallback communication channel if email is unavailable
- Response playbooks for ransomware and email compromise
The need
When organizations need it
- When the board asks how quickly the organization could recover from a ransomware attack.
- When your response plan has never been compared to the actual state of your systems since it was written.
- When preparing your bank's response plans for the annual test required by regulations such as DORA.
Method
How we work
-
Documents and interviews
We review the plan, roles and past incident records. We interview IT, legal and communications teams.
-
Technical checks
We sample real systems to check log retention, EDR coverage and backup access.
-
Scenario walk-through
We walk through the plan step by step using ransomware and email compromise scenarios, noting where it stalls.
-
Action list
We rank gaps by the delay they would cause in an incident and assign each to an owner.
Outcome
What you have at the end
You know in advance at which step a response would stall. Gaps are ranked by the delay they would cause and assigned to an owner.
Frequently asked questions
Is this the same as an exercise?
No. A readiness assessment measures the actual state of the plan and systems. A cyber incident exercise tests how teams make decisions under pressure. The two complement each other.
Do you make changes to our systems?
No. We review configurations and logs with read-only access. If you want to test an actual restore from backup, we plan that separately.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting