Incident response planning, playbooks, and executive and technical tabletop exercises to test decisions, response roles, and recovery readiness.
Incident readiness covers the plan, the people, and the proof that they work together. Three services sit under this core. Incident Response Planning & Readiness builds or rewrites the policy, plan, playbooks, severity matrix, and notification decision tree against recognized incident response guidance. Executive Tabletop Exercises put leadership through the decisions an incident forces: activation, ransom posture, counsel and insurer engagement, and disclosure clocks. Technical Tabletop Exercises walk responders through detection, containment, eradication, and recovery on a scenario built from your own environment, whether on-premises, cloud, or hybrid. Most clients start with the plan, then test it with one exercise per audience on a shared scenario. The same principal reviews your documents, writes the scenario, facilitates the session, and writes the after-action report. Exercise findings land as redlines in the plan, not in a slide deck. Nothing here touches production. Readiness is documentation, discussion, and evidence, not incident handling on your behalf.
For CISOs, CIOs, general counsel, and compliance leads who own the response when something goes wrong. You need to show a board, insurer, customer, or assessor that the plan exists and has been exercised. Common triggers: a cyber insurance renewal, a new defense contractor or PCI DSS obligation, a near miss, or the first time an executive asks what happens if ransomware hits.
We start with your existing incident response policy, plan, playbooks, insurance policy, monitoring provider contracts, and every reporting clause in play. Then we agree in writing which documents we build, which audience we exercise, and which scenario we run. You choose what is recorded and who receives the after-action report.
The principal interviews stakeholders, drafts each artifact against recognized incident response guidance, and writes the scenario and timed prompts for each exercise. Sessions are discussion-based and run without keyboards or production access. Participants say what they would do, and we record where the plan, the tooling, and the people diverge.
You receive the finished documents, an after-action report and improvement plan with corrective actions assigned to owners and dates, and redlines to the plan and templates. Once corrections land, we re-run the affected module or walkthrough and record the result as evidence for insurers, customers, and assessors.
An incident response policy, plan, playbooks, and notification decision tree written for your organization and proven in a walkthrough.
From $6,000
Scope, pricing & FAQsA facilitated, scenario-driven exercise that puts leadership through the decisions a serious incident forces, then records what has to change.
From $3,000
Scope, pricing & FAQsA response-team walkthrough of detection, scoping, containment, eradication, and recovery on a scenario built around your own systems and logs.
From $4,200
Scope, pricing & FAQsThe selected services, deliverables, access requirements, and any follow-up validation are agreed in your engagement scope.
A focused conversation. A clear scope. A practical path to stronger security.
