Incident Response · Planning
Service group: CybersecurityDecide how you will respond to an incident before one happens
We help you write a practical incident response plan, build playbooks for the scenarios you are most likely to face, and rehearse them with your leadership through tabletop exercises, so the first hours of a real incident are not spent improvising.
At a glance
- Service
- Development of an incident response plan, scenario playbooks and facilitated tabletop exercises
- Best suited to
- Organizations of roughly 5 to 200 employees without a written, tested incident response plan
- Deliverables
- Incident response plan, roles and contact list, scenario playbooks, communication templates, tabletop exercise and after-action report
- Explicitly not
- A forensic retainer, breach investigation, legal advice or ransom negotiation service
- Frameworks referenced
- NIST CSF 2.0 Respond and Recover functions, NIST incident handling guidance and Canadian Centre for Cyber Security incident planning guidance
- Pricing basis
- Fixed fee for the plan and exercise, with annual reviews optional, confirmed in a written quotation
- How to start
- Book a consultation to choose scenarios and participants
What incident response planning delivers
An incident response plan sets out who does what when a security incident is suspected: who has authority to shut systems down, who calls the insurer, who speaks to staff and clients, how evidence is preserved, and how the business decides when it is safe to recover. Playbooks add step-by-step guidance for specific scenarios such as ransomware, a compromised mailbox or a lost laptop.
A plan only works if people have practised it. Tabletop exercises put your leadership team in a realistic scenario and walk through decisions in real time. They reveal missing contacts, unclear authority and assumptions about backups or insurance before a real incident does.
This is a planning service. It is not a forensic retainer or an on-call breach response team. Part of the plan is identifying who you would call for forensic investigation and legal advice, often through your cyber insurer's panel, and making sure those contacts are ready.
Why plans are needed
Nobody knows who decides
During an incident, staff wait for permission to disconnect systems or call the insurer, losing valuable time.
Missing contacts
The insurer's breach hotline, policy number and legal adviser's details are buried in email no one can reach.
Evidence destroyed by accident
Well-meaning staff wipe and rebuild devices before logs are preserved, making investigation harder.
Notification uncertainty
Leadership is unsure whether privacy law, contracts or regulators require notification and on what timeline.
What we build with you
Incident response plan
Roles, authority, severity levels, escalation paths, evidence preservation basics and recovery decision criteria, written for your organization.
Contact and resource list
Internal roles, IT provider, insurer, breach coach, legal adviser, forensic firm and key vendors, kept accessible offline.
Scenario playbooks
Concise steps for your likely scenarios, typically ransomware, business email compromise, lost or stolen device and insider data misuse.
Communication templates
Draft messages for staff, clients and suppliers, for review by your legal advisers before use.
Tabletop exercise
A facilitated session that walks leadership through an evolving scenario with injects and decision points.
After-action report
Findings from the exercise with plan updates and improvement actions assigned to owners.
Scope
Included
- Interviews with leadership, IT contacts and key staff
- Review of insurance policy incident requirements you provide
- Written incident response plan and contact list
- Scenario playbooks for agreed scenarios
- Communication templates for legal review
- One facilitated tabletop exercise and after-action report
Not included
- Forensic retainer or guaranteed incident response availability
- Breach investigation, malware analysis or evidence handling for litigation
- Legal advice, including whether PIPEDA or provincial breach reporting applies
- Ransom negotiation or payment
- Public relations or crisis communications services
Tools and references
- NIST CSF 2.0 Respond and Recover functions
- NIST SP 800-61 incident handling guidance
- Canadian Centre for Cyber Security incident response planning guidance for small and medium organizations
- Microsoft 365 audit logs and Defender data sources relevant to evidence preservation
- Office of the Privacy Commissioner of Canada breach reporting resources, for your legal advisers
Who it is for
Organizations with no written plan
Businesses that would rely on memory and goodwill if an incident happened today.
Firms holding personal information
Healthcare, accounting, legal and nonprofit organizations that need to be ready to assess privacy obligations quickly.
Leadership teams answering insurers
Organizations whose cyber insurance application asks whether an incident response plan exists and has been tested.
Benefits
- Faster, clearer decisions in the first hours of an incident
- Evidence preserved for insurers, investigators and legal advisers
- Contacts and authority agreed before they are needed
- Leadership confidence from having rehearsed a scenario
- A documented plan for clients, insurers and auditors
How the engagement runs
Discovery
We interview leadership and IT, review your insurance requirements and choose priority scenarios.
Plan drafting
We write the plan, contact list and playbooks and review them with you.
Exercise design
We build a realistic scenario with injects tailored to your systems and people.
Tabletop exercise
We facilitate the session with your leadership team, remotely or in person where confirmed.
After-action and update
We deliver findings, update the plan and recommend an annual review cycle.
Ways to buy
Fees are proposed and confirmed in a written quotation.
Plan and exercise package
The full plan, playbooks and one tabletop exercise for a fixed fee.
Tabletop exercise only
For organizations with an existing plan that needs testing.
Annual review
A yearly update of the plan and contacts with a new exercise scenario.
About breach reporting obligations
Under PIPEDA, organizations must report to the Office of the Privacy Commissioner of Canada and notify affected individuals of breaches of security safeguards involving personal information that create a real risk of significant harm, and keep records of all such breaches. Provincial privacy laws and contracts may also apply. Your plan will name the legal adviser who makes these determinations; we do not provide legal advice.
Frequently asked questions
Is this the same as an incident response retainer?
No. We prepare your plan and team. A retainer with a forensic firm, often available through your cyber insurer, provides investigators during an incident. Your plan will identify that firm and how to engage it.
Will you help if we have an actual incident?
If you are a managed services client, we follow the plan within our agreed scope and hours to contain and restore systems. Forensic investigation and legal advice come from the specialists your plan names.
How long is a tabletop exercise?
Typically a few hours for leadership. We confirm the format and duration when designing the scenario.
Does the plan need to be updated?
Yes. People, insurers, systems and vendors change. We recommend at least an annual review and an update after any significant incident or organizational change.
Related services
Products and packages
Industries we support
Service areas
Give your team a plan before it needs one
Book a consultation to choose your scenarios and receive a fixed-fee proposal for a plan and tabletop exercise.