Incident Response Readiness & Retainer

The worst time to work out who decides, who calls the regulator and who can authorise taking production offline is at two in the morning.

We build and test the capability you need before an incident: the plan, the playbooks, the decision rights, the notification obligations, and a retainer agreed while everyone is calm. What we are not is a twenty-four hour operations centre, and this page is explicit about where that line sits.

The plan is worth what it is worth when it is rehearsed

What we do, and what we do not

We prepare organisations to respond, and we hold retainers so the commercial and legal groundwork is done in advance. We do not staff a round-the-clock detection service. Where an engagement needs live incident handling, that is delivered with a specialist response partner whom we coordinate and who is named in your retainer before you sign it. We would rather tell you this here than during an incident.

Who this is for

Four positions organisations find themselves in

There is a plan nobody has opened

It was written for an audit, it names people who have left, and no one has tested whether it survives contact.

You had a near miss

Something happened, it was handled by improvisation, and it exposed how much depends on one person being reachable.

You have no arrangement in place

If it happened tonight, you would be negotiating terms with a response firm while the incident ran.

You have notification duties

Canadian privacy law imposes reporting obligations with real deadlines, and someone needs to know what is owed and to whom.

What we build

The capability, not the document

Incident response plan

Written for use under pressure: short, role-based, and free of the process diagrams nobody reads at 3am.

Playbooks for likely scenarios

Ransomware, business email compromise, data exposure, third-party breach — the specific first moves for each.

Decision rights and escalation

Who can declare an incident, who can authorise disconnection, who speaks to customers, and who is called when they are unreachable.

Tabletop exercises

Run separately for the technical team and for leadership, because the two groups fail in entirely different ways.

Readiness assessment

Whether you would have the logs, access and evidence an investigation depends on. Usually the most sobering part.

Retainer arrangements

Terms, contacts and escalation agreed in advance, including the named response partner for live handling.

How we work

Build it, then try to break it

Assess readiness

What exists, what is current, and whether the evidence an investigation would need is actually being retained.

Build the plan and playbooks

Written with the people who would use them, so the document reflects how your organisation genuinely operates.

Exercise it

A scenario run against the plan with the real participants. This is where the gaps appear, and it is the point of the whole exercise.

Fix and formalise

Revisions from what the exercise exposed, and the retainer put in place so nothing commercial has to be negotiated later.

Deliverables

What you receive

An incident response plan written to be used under pressure rather than filed
Scenario playbooks for the incidents you are realistically exposed to
A decision and escalation map naming roles, deputies and out-of-hours contacts
A readiness assessment covering evidence, logging and access, with the gaps that would obstruct an investigation
An exercise report recording what the tabletop exposed and what was changed as a result
A notification summary setting out your obligations under Canadian privacy law and who has to be told, within what time

Scoping

Timing and cost

Cost depends on the size of the organisation, how many scenarios and exercises are in scope, whether leadership sessions are included, and whether a retainer is being put in place alongside the readiness work.

We do not publish packages or rates. Every engagement begins with a short call, followed by a written scope and a fixed price for that scope before any work starts. Retainer terms are set out in writing before you commit to them.

What we need to scope it

Whether a plan exists today, whether it has ever been exercised, roughly how many people would be involved, and whether you have any response arrangement in place now.

FAQ

Common questions

If we are breached tonight, do we call you?

Call us and we will mobilise the arrangement — but be clear about what that means. We coordinate the response and work alongside a specialist response partner who does the live handling. If you hold a retainer, that partner is named and the terms are already agreed. Without a retainer there is nothing pre-arranged, which is precisely the situation the retainer exists to prevent.

Why not just offer twenty-four hour response yourselves?

Because it would not be true. A genuine round-the-clock capability means staffed shifts and a rota, and claiming one without it is the kind of thing that comes apart at the worst possible moment. We would rather be straightforward about the boundary and be reliable inside it.

Is a tabletop exercise worth it if we already have a plan?

It is usually more valuable then, not less. An untested plan is a set of assumptions. Exercises reliably surface the same things — a decision nobody can actually make, a contact list that is out of date, and an assumption that logs exist which do not.

Who should attend the exercises?

The people who would really be in the room. Technical responders in one session; the executives who must decide about disclosure, payment and customer communication in another. Combining them tends to produce a session where nobody says the difficult thing.

Do you advise on ransom payment?

We will lay out the considerations, the legal exposure and what the decision typically turns on, and we will make sure the decision is made by the right people with the right advice rather than under pressure by whoever is on the call. The decision itself is yours, taken with counsel.

Does the retainer include the readiness work?

They are usually bought together but scoped separately, because organisations arrive at different points. Some need the plan built first; others have one and simply want the commercial arrangement in place. Both are defined with you.

Tell us what you have in place today

Even if the answer is nothing. Thirty minutes and we will tell you what is worth doing first and what a retainer would cover.

Start with a scoping call