Incident Response

Details and scope

Support a scheduled investigation and containment workstream for one defined incident. Incident timeline, evidence register, containment recommendations and recovery action plan. Evidence and actions are traceable in the final report; customer approves containment changes. The stated scope is agreed before work starts; additional work is quoted separately.

Specifications

• 50 specialist-hours; up to 5 systems and 3 evidence sources; business-hours schedule agreed at intake
• 50 specialist-hours including preparation, delivery, checks and handover
• Incident timeline, evidence register, containment recommendations and recovery action plan
• Acceptance: Evidence and actions are traceable in the final report; customer approves containment changes
• Excludes: Guaranteed immediate availability, court expert evidence, ransom negotiation and guaranteed recovery