An employee who reports an unexpected sign-in or a suspicious attachment needs a useful response, even if they are unsure what happened. For the systems covered by your agreement, we establish what is known, investigate the affected account or computer and explain the next action. Interrupting access can affect other work, so the business needs an agreed person who can approve those decisions.
A wider incident may involve an insurer, legal adviser, specialist investigator or application provider.
We help coordinate the technical information and responsibilities within our scope. Specialist response services and their charges need to be clear before they are required.
After an issue is contained, there may still be work to do: restoring access, checking recovery options, correcting the original weakness and explaining what remains uncertain. Those follow-up decisions matter to the owner as much as the initial warning.