--- title: "Incident response" description: "Incident response retainers, containment and forensic investigation, recovery support, and tabletop exercises that rehearse the decisions in advance." url: https://www.expandware.com/services/managed-security/incident-response/ section: "Services" topics: ["Managed Security", "NIST SP 800-61", "ISO/IEC 27035", "GDPR breach notification", "NIS2 incident reporting"] publisher: "Expandware Private Limited" --- # Incident response Incident response retainers, containment and forensic investigation, recovery support, and tabletop exercises that rehearse the decisions in advance. When an incident happens, a plan and a team are already in place. The first hours of an incident decide how much it costs. Organizations that have agreed who decides, who is told, which systems are isolated and which regulators must be notified recover faster and pay less. We prepare that in advance with plans and exercises, and when an incident happens we respond: containment, investigation, eradication and recovery, with evidence preserved for insurers, regulators and courts. Where it usually starts: - There is an incident response plan, but it has never been rehearsed. - Nobody knows which regulatory notification deadlines would apply. - Your cyber insurance requires an incident response provider. - Something suspicious is happening right now. What is included: - Response retainer: Pre-agreed access to responders, with terms settled before they are needed. - Containment: Affected systems and accounts isolated to stop the spread. - Investigation: Forensic analysis of how the attacker got in and what they reached. - Recovery: A clean rebuild and restoration, monitored for any return. - Notification support: Evidence and timelines for regulators, insurers and affected parties. - Tabletop exercises: Leadership and technical teams rehearse decisions in a realistic scenario. Where it sits: Incident response is the far end of the security architecture's respond layer: when containment is not enough, responders investigate, eradicate and recover, and feed what they learn back into detection. Decisions to settle early: - Retainer or call when needed. Without a retainer, contracting happens during the incident; with one, responders start at once. Insurance terms often decide. - Who leads the response. Your leadership makes business decisions; responders lead the technical work. The plan says who does what. - When to involve law enforcement. Reporting can help and may be required, but it has consequences. Counsel decides, with the facts we establish. How the work runs: Prepare, Plans, contacts and decision rights. Contain, Stop the spread and preserve evidence. Investigate, Root cause and scope of impact. Recover, Rebuild, restore and harden. How it is bought: - A fixed-fee assessment: Preparation starts with a review of your plan, contacts, insurance terms and notification duties, often with a tabletop exercise. You receive the gaps and a fixed price for preparation or a retainer. - A fixed-price build: Plan writing, playbooks and exercises are priced as a fixed program. An active incident is handled under the retainer's agreed terms. - Running it afterwards: A retainer keeps responders on call with terms settled in advance, and unused time goes to preparation such as exercises and plan reviews. Worked example, ransomware on a saturday morning. Say a distribution company finds files encrypted on its file servers early on a weekend. It has an incident response plan, written last year and never rehearsed, and its insurer must be told before a responder is engaged. - Mobilize: The insurer is notified under the policy, our responders are engaged, and the decision makers named in the plan are brought together on one call. - Contain: Affected servers and the accounts the attacker used are isolated, with memory and disk images preserved before anything is wiped. - Investigate: Forensic analysis traces the entry point to a compromised remote access account and establishes which data was reached. - Recover: Systems are rebuilt from clean backups, the entry point is closed, monitoring watches for a return, and the evidence pack supports the notifications. At the end, the company has recovered, knows how the attacker got in and what they reached, and has met its notification duties with evidence rather than estimates. (An illustration, not a client account.) What you have at the end: - Incident response plan and playbooks: Who decides, who is told and what is done in each kind of incident, written for your organization and its regulators. - Tabletop exercise report: What the exercise showed about your plan, contacts and decision rights, and what to change. - Incident timeline and forensic findings: How the attacker got in, what they did and reached, and the evidence behind each finding. - Recovery and hardening plan: How systems are rebuilt from a trusted state, and the changes that stop the same attack working again. - Notification evidence pack: The facts, timelines and decisions regulators, insurers and affected parties need, assembled as the incident runs. Standards and platforms worked with: NIST SP 800-61, ISO/IEC 27035, GDPR breach notification, NIS2 incident reporting, DORA incident reporting, SEC cybersecurity disclosure. Where it goes wrong, and what we design out: - A plan never rehearsed. Plans that have not been exercised fail at the first decision. Tabletop exercises test who decides before it matters. - Cleaning instead of rebuilding. Removing what is found leaves what is not. Compromised systems are rebuilt from a trusted state. - Evidence lost in the rush. Wiping systems quickly destroys what insurers and regulators need. Evidence is preserved before recovery begins. What it changes: - Faster containment. Decisions rehearsed in advance are made in minutes during a real incident. - Deadlines met. Notification duties are known in advance, with evidence ready when regulators ask. - A clean recovery. Systems are rebuilt from a trusted state, so the attacker does not come back. How you will know it is working: - Leadership knows who decides in an incident, and has practised it. - Notification deadlines are listed in the plan before they are needed. - Recovered systems stay clean afterwards. - Your insurer's requirements are met in advance. Who you work with: - Incident lead. Runs the technical response, coordinates with your leadership and keeps the timeline. - Forensic analyst. Preserves evidence, traces the attack and establishes what was reached. - Recovery engineer. Rebuilds systems from a trusted state and closes the entry point. What we need from you: - Your incident response plan and contact lists, if they exist. - Your cyber insurance policy terms. - Access to logs, backups and security tools. - Decision makers available for exercises, and in a real incident. Common questions: Q: We think we are under attack now. What should we do? A: Call the number in the contact section at the foot of this page, and write to solutions@expandware.com with the word incident in the subject. If you are already a client, use the route on the Client Support page, where the response targets in your agreement apply. Disconnect affected machines from the network rather than powering them off, unless they are actively encrypting data, because memory holds evidence. Q: What is a tabletop exercise? A: A facilitated session in which leadership and technical staff work through a realistic incident scenario, decision by decision. It reveals gaps in the plan, the contact lists and the lines of authority without the cost of a real incident. Q: How quickly do we have to notify regulators? A: It depends on the law and the sector. Under the GDPR it is 72 hours from becoming aware of a notifiable personal data breach; NIS2 requires an early warning within 24 hours of a significant incident; other regimes set their own clocks. The plan we write for you lists the deadlines that apply to you. Q: Will you work with our insurer? A: Yes. Many policies name approved responders or require notification before one is engaged, so we check the policy terms as part of preparing the plan. Q: Should we pay a ransom? A: That is a decision for your leadership, informed by legal advice, your insurer and the law where you operate; some payments are prohibited outright by sanctions rules. Our part is to establish the facts quickly: whether backups can restore the systems, what data was taken, and what paying would and would not change. Q: What does an incident response retainer include? A: Terms, contacts and access agreed in advance, so responders can start without negotiating a contract during an incident. A retainer usually includes preparation as well, such as a plan review or a tabletop exercise, and time not used on incidents can go to that preparation. Q: How is evidence preserved during an incident? A: Memory and disk images are captured from affected systems before they are cleaned, logs are copied out of systems an attacker could alter, and every item is recorded with when and by whom it was collected. That chain of custody is what lets the evidence stand up with insurers, regulators and courts. Q: How do we know the attacker is really gone? A: By finding how they got in and every foothold they established, then rebuilding affected systems from a trusted state rather than cleaning them. Monitoring stays heightened after recovery, watching for the techniques and infrastructure the attacker used, so a return is noticed early. Often paired with: 24/7 SOC and MDR, Backup and disaster recovery, Governance, risk and compliance. --- Canonical page: https://www.expandware.com/services/managed-security/incident-response/ Site index for machines: https://www.expandware.com/llms.txt Full site text: https://www.expandware.com/llms-full.txt Expandware Private Limited. Inquiries: solutions@expandware.com, +92 (333) 32 11011.