Incident response readiness
Readiness is a week your team can already run.
Ready means a named owner can revoke access, the system list is believable, and the people already there can do it at night. An unused binder is not readiness.
Where it breaks
The incident sits between IT, the person who built the workflow, and a vendor. Two owners, or none. Same finding as any stalled handoff. The week is shorter.
A hotline is a different purchase. We put owners and a cadence in place with the people you have, before that contract is the question. Ownership and cadence sit under this.
Questions that show readiness
We ask these of one incident. A lost laptop. A vendor account. A payment system. A customer-data export.
- Who is called first, and who may decide.
- Who can disable an account, a key, and a vendor session, and how long that takes on a Friday.
- Where the list of systems that hold customer data lives, and when it was last checked against what is running.
- Whether offboarding is current enough that the access list can be trusted.
- Who speaks to customers, and who speaks to the insurer or the auditor, and whether they share the facts.
- Whether the week after can show what was done. For SOC 2 or PCI, the evidence has to match the path taken.
If two have no name, the gap is owners. We write the blanks. That list beats a policy nobody has walked.
What we put in place
- One owner for the incident, and a second person who can act if the owner is unreachable.
- A current access list for the few systems that matter, and a revoke step someone has used.
- One place the timeline is written while the work happens.
- A cadence the week already runs. A bridge no one remembers is not a cadence.
- A decision, made on a quiet day, about what will not be done in the first hour.
No new hire. We make the products and the processes agree on the path.
What we will not do
We map how an incident would move. We name one owner on each duty that can stop it. We join the access and the records. We leave the cadence with your team. Same method: map, name, join, prove, leave.
We do not sell a 24-hour retainer. We do not quote a response time. If you need a firm on the keyboard during an active breach, say so. We will say if this is not the fit.
An audit or a questionnaire starts at SecOps consulting. Neighbor to this. Not the same afternoon.
Prove it on a quiet week
We run the questions on one system you task us with, with the people who would be called. We record what held, what slipped, what changed. An unused diagram is not a result.
One system. One hour. A named owner and a revoke step someone has used is the result. An argument about who decides is the finding. You do not run the hour. We do.
Contact
Task us with the system.
Task us with the system, and who would be called today. We reply with a scoped visit, or we say you need a response firm we are not.