Incident response
Know exactly what to do when something goes wrong
When something goes wrong, people need to know who is in charge and what to do next. This module gives you a plan, a record and a way to learn from it.
Fix what matters first
In the moment, nobody is sure what to do.
No agreed plan
Without a plan, the first hour is spent deciding who is in charge instead of limiting the damage.
No record of what happened
Notes in chat and email are hard to piece together afterwards, when a client, insurer or regulator asks.
Lessons are lost
Once the incident is over, the fixes that would stop a repeat often never get done.
What changes
From scramble to a clear process.
Before
Your incident response plan is written down, with roles agreed and a practice run if you want one.
During
The incident is logged, rated and given a commander. Every action is recorded with the time.
After
Findings flow into the Action Hub and the risk register, so the fixes get done.
How it works
How it works.
Log and classify the incidentSay what happened, how serious it is and who is in charge.How this works underneath
Each has a severity, a status and a commander. The register shows open and closed incidents together.Record every actionA dated timeline of what was found and done.How this works underneath
Actions such as isolating systems, removing malware and restoring services are recorded in a time-stamped timeline. This gives you a dated record to support a breach notification, if one is needed.Turn findings into fixesWhat you learn becomes tasks and risks.How this works underneath
Post-incident findings are sent to the Action Hub and can update the risk register. AI-assisted response plan drafting is available for you to review and edit.
A small example
What this can look like.
- Situation
- A finance team member clicks a link in a suspicious email and reports it.
- What is recorded
- The incident is logged as high severity and a commander is assigned. Each step is timed: systems isolated, malware removed, systems restored.
- What happens next
- Three follow-up actions go to the Action Hub, including a staff reminder and a review of email filtering.
- What is kept
- The timeline stays on record for the client, insurer or regulator, if asked.
This is an invented example to show how the module works. The names and figures are not a real customer's.
What is in it
What is in incident response.
Incident register
Every incident with severity, status, commander and date.
Time-stamped timeline
A record of what was reported, decided and done, and when.
Response plan
A written plan with roles, with AI-assisted drafting for you to review.
Findings to the Action Hub
Post-incident fixes become owned tasks.
Link to the risk register
What you learn can update your risks.
Questions
Common questions.
No. It is the plan and record you keep. If you need hands-on help during an incident, talk to us about our managed security service.
It keeps a dated record of what happened and what was done, which supports a notification if you need to make one. It does not decide whether you must notify.
Yes. You can write your plan and run a practice exercise so roles are clear in advance.
Related
Works with.
Be ready before something goes wrong.
The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.