Advisory service

Incident Response Planning.

Playbooks built before you need them. Tabletop drills, communication templates, escalation paths, retainer-ready capability that activates when a real incident hits.

The incident response plan that lives in a wiki nobody reads is no plan. The one that gets used at 02:00 has been pressure-tested by people who have run real incidents. We build the latter.

What this includes

  • Incident classification and severity model (aligned to ENISA/NIST)
  • Role-specific playbooks for the top 8 to 12 scenarios
  • Communication templates for internal, customer, regulator, media
  • Escalation paths with named individuals and backup contacts
  • Tabletop exercise programme (two exercises in year one)
  • Optional: retainer for on-call activation

How we run it

01

Scope

Identify the scenarios that matter for your business. Not every plan needs to cover every scenario.

02

Build

Write the playbooks with the people who will use them. Tested, not theoretical.

03

Drill

Run the first tabletop exercise. Refine the playbooks based on what breaks.

04

Operationalise

Embed the plan in your operating rhythm. Quarterly reviews, annual refresh.

What you get

  • Incident classification and severity model
  • Eight to twelve scenario playbooks
  • Communication templates pack
  • Escalation contact matrix
  • Tabletop exercise report and recommendations
  • Optional retainer agreement for on-call response

Why this matters

The two costliest mistakes in incident response are (a) classifying too low at the start, and (b) communicating in panic mode rather than from a script. Both are eliminated by a tested playbook. Drill before the real thing.

Questions we get

Should we have an internal team or a retainer?

For most mid-market entities, a small internal team coordinated through a retainer for surge capacity works best. Pure internal teams burn out; pure external arrangements lose institutional knowledge.

How often should tabletops be run?

Twice per year for management, quarterly for technical teams, with annual full-organisation drills. Anything less and the muscle memory atrophies.

Do you include forensics capability?

Forensics is a separate engagement scope. We design the IR plan to interface cleanly with forensics partners, and can recommend qualified firms if you do not have one on retainer.

Next step.

A 30-minute scoping call clarifies whether your situation fits this engagement.

Request a briefing