Decide the response before the day arrives.
Prepare on the assumption it will happen — from detection and first response through forensic investigation and post-incident hardening, handled end to end.
Before, during, and after — without a gap.
Before
Build the capability to investigate while things are calm — logging design, preservation policy, and escalation paths.
During
Detection, first response, and forensic investigation. We scope the damage using procedures that keep the evidence intact.
After
Reporting and prevention. We turn root cause into concrete changes to configuration and operations.
- Detection
- First Response
- Forensics
- Post-Incident
Every engagement is scoped on its own terms.
Requirements
Confirm the objective, the scope, and the questions the investigation has to answer, then design the plan.
NDA
Execute the non-disclosure agreement and define how materials and deliverables are handled.
Quotation
A quotation stating scope, effort, and delivery schedule.
PO
Work formally begins on receipt of the purchase order.
Investigation
Evidence preservation, analysis, and the written report.
Reserve the capacity a year ahead.
The annual incident response ticket plan sets aside investigation capacity in advance, so response is not waiting on a quotation and a purchase order.
Ticket Unit
- 1 ticket = 1 person-day = 8 hours
- Reserved under an annual contract
Typical Scope
- Single PC investigation — up to 12 tickets
- Server plus PC — up to 24 / 30 tickets
First Response
- 12–16 tickets on average