What does incident readiness support cover?
We create, review or refresh incident response plans, scenario specific playbooks, cyber continuity and recovery arrangements, and crisis communications. Supporting work can include roles and deputies, escalation criteria, contact arrangements, decision records and team walkthroughs. You can commission one focused piece or a connected planning project, tailored to your priorities.
How do response, continuity and recovery plans differ?
The response plan coordinates how an incident is recognised, escalated and managed. Continuity arrangements help protect your ability to do business and operate in adverse conditions by setting out how essential activities can continue during disruption. Recovery arrangements set priorities and dependencies for restoring systems, information and services. Communication arrangements connect them, so people know who approves and shares updates.
Can you review an existing plan?
Yes. We review how your current arrangements fit the business, identify gaps and revise the agreed documents. A focused refresh can follow a business or system change, assessment, audit, incident or exercise. Useful existing material is retained and connected rather than replaced unnecessarily.
Can you help with ransomware or data breach playbooks?
Yes. We can develop playbooks for agreed scenarios such as ransomware, suspected data loss, compromised accounts, email fraud or a critical supplier outage. Each is based on your environment and sets out relevant triggers, roles, escalation and decision points. Specialist technical response procedures are agreed with the people responsible for carrying them out.
Who needs to take part?
Usually the business owner or leadership representative, operational owners and the people responsible for IT. We involve finance, HR, communications and external providers where relevant. We agree participants upfront so responsibilities, dependencies and practical constraints are reflected in the plans.
Do we need to commission every type of plan?
No. Start with the gap or priority you need to address. That could be a review, one playbook, communication arrangements or a connected set of plans. Your proposal specifies the work, documents, workshops, responsibilities and fixed price before delivery begins.
How do we know whether the plan will work?
An agreed briefing and walkthrough help people understand their roles and reveal unclear ownership or dependencies. A separately scoped tabletop exercise can then rehearse decisions, communication and escalation. Technical recovery testing is also scoped separately. A plan or walkthrough does not guarantee the outcome of a real incident.
Can you implement improvements and keep the plans current?
Your team and providers can address the agreed actions, or commission modular implementation through Security Foundations. A Cyber Resilience Partnership can include scheduled plan reviews, updates and exercises within its agreed programme. Documents have named owners and a review approach; ongoing delivery is agreed separately.
Is this an emergency response service?
This service is about preparation. Live incident assistance, availability and response commitments must be specifically agreed. It is not a 24/7 emergency response hotline.
