Incident response
Before the incident: roles, retainers, and a plan. During it: containment, evidence, and communication that does not make it worse.
For Companies that have a policy and no one who has practiced it.
Outcomes
- A plan people have walked through
- Forensic readiness: logs you can actually use
- A retainer path if you want one
What is included
- IR plan and roles
- Tabletop exercise
- Logging and evidence checklist
- CERT-In and customer notification prep where relevant
Platforms: SIEM, EDR, CERT-In
Start with this