Incident Response

Although not wanted incidents do occur. Proper incident planning ensures that teams have awareness of what their responsibilities are, not only in preventing the incident from occurring but how they support the recovery operation.

​Should the worst happen being able to recover in the quickest time possible in key. It may mean prioritising a smaller number of systems in order to be operational and working on the remaining ones later. In an ideal situation this would be covered in an incident plan, but we recognise this may not always be the case.

When systems are operation there is the opportunity to carry out detailed analysis. This enables an organisation to gain an in depth of understanding of what occurred and how the incident occurred. This information can be captured earlier on and stored whilst systems are recovered.

​Understanding the true root cause and acting upon it is key to prevent a reoccurrence. This may be something simple such as patching a vulnerability or could be something more challenging such as addressing users clicking links in phishing emails.