Contact Us

Contact Us

Please get in touch using the form below

1000 characters left
I prefer to be contacted by:
View our privacy policy
Book a penetration test today. Get in touch.

Overview

Expert support for robust incident response planning

An Incident Response Plan (IRP) is a document which sets out an organisation’s strategy for responding to different types of security incidents, including ransomware attacks, IP theft and data breaches.

An incident response plan outlines the specific procedures and responsibilities associated with addressing each stage of an incident, with defined roles for completing specific incident response actions. An IRP is your organisation’s roadmap for taking timely and effective action in the event of disruption caused by a cyber-attack.

Kroll responds to more than 3000 security events every year, including some of the most complex investigations in the world. Whether you’re looking to validate your existing incident response plan or develop a new one, we are well placed to assist. Our methodology combines our front-line experience of investigating persistent and emerging threats with guidance from leading security standards to fully support the unique needs of your organisation.

Incident response planning services

Incident response planning services based on unique insight

For both IRP creation and validation, our experts follow a methodology that integrates our extensive experience of investigating threats with guidance from leading security standards, such as the NIST Cybersecurity Framework.

Our incident response planning services include:

  • Incident response planning and validation
  • Assignment of Incident Response Team (IRT) responsibilities
  • Gathering and documenting key information
  • Establishing a review and testing schedule
  • Developing communications procedures and responsibilities
  • Determining the person with authority to declare an incident

Features

Cyber incident response planning service features

Preparation and validation

As well as helping you build and implement an effective incident response plan, our incident response service and security assessment experts can also validate its effectiveness through the use of table-top exercises, such as Red Team Operations and Scenario-based Assessments.

Documentation and protocols

Our experts will help you to identify the right type of information required in the event of an incident and ensure it is properly documented. Acting without a plan could lead to the loss of critical evidence. We can provide targeted advice about the right steps to take once you have detected an issue.

Review and test scheduling

Developing and implementing an IRP should never be treated as a one-off exercise. We can help you identify and define measures for updating your plan and set a regular testing schedule to ensure your plan is effective over time.

Developing communications procedures and responsibilities

Communication is key in a crisis. We can help you determine how to communicate securely in the event of your corporate email becoming inaccessible or unsafe to use. We can also help you identify the most appropriate person to communicate with external parties such as regulators and the media.

47%
of security leaders lack clarity on engaging counsel
46%
of businesses can't contain a threat within the hour
43%
of organisations lack readiness for breach notification

FAQ

Incident response planning FAQs

What is incident response?

Incident response is the strategy an organisation uses to manage and mitigate cyber security incidents. Incident response aims to contain and limit the damage and disruption of cyber-attacks. It usually also includes steps to restore business operations as smoothly and quickly as possible.

What is a security incident?

A cyber incident or cyber security incident is any type of event with the potential to negatively impact an organisation through a compromise of confidentiality, integrity or availability. Types of events include unauthorised data breaches, unlawful data processing or a denial of service.

What is the most effective way to respond to a security incident?

The best response to a security incident is to follow a clear incident response plan which will have already defined the key actions, people and responsibilities to be involved. Following an incident response plan reduces the risks of damaging delays or mis-steps in response.

What is an incident response plan?

An incident response plan sets out how an organisation will respond to different types of security incidents. It enables better mitigation of cyber incidents by clearly outlining which actions need to be taken and the people responsible for those steps.

What does an effective incident response plan include?

A robust incident response plan will cover guidance for:

  • Assigning responsibilities between responders
  • Setting technical protocols and escalation points
  • Defining a strategy for resource-gathering and documentation
  • Setting up communications and notification procedures
  • Establishing a review and testing schedule
What are the key incident response steps?

The six main incident response steps are:

  1. Preparation – incident response planning and process creation
  2. Identification – information gathering and incident analysis
  3. Containment – patching and damage limitation
  4. Eradication – threat removal and mitigation
  5. Recovery – returning systems to full operation
  6. Learning – identification of improvements, further testing

Get immediate assistance

Get in touch

Comprehensive support

Effective response planning - whatever the incident

What’s the first thing you should do when you discover that your organisation has been affected by a security incident? Which steps should you take to contain and minimise the harm to your business continuity and reputation?

Our incident response planning services reduce the potential damage of a cyber incident by setting out a strategic roadmap outlining the steps your organisation needs to take in the event of different types of attacks. Having an IRP in place also communicates to stakeholders and regulators that your organisation is fully committed to addressing new and emerging cyber threats.

Kroll’s incident response planning services can help your organisation become better prepared to respond to:

Advanced Persistent Threats
Business Email Compromise
Insider threats
Ransomware
Supply chain attacks
IP theft

About Us

Why choose Kroll?

  • Flexible, on-demand services
  • Recognised by CREST and the PCI Council
  • Global team of cyber risk experts
  • >3,200 security incidents responded to every year

Get in touch

Complete the form for a prompt response from our team.

Two Redscan team members analysing cyber security intelligence

1000 characters left
I prefer to be contacted by:
View our privacy policy

Resources

Discover our latest content and resources

From the blog
From the blog Case studies Latest news
15th August 2022
Ransomware data theft increase helping to drive BEC attacks
A sharp rise in corporate data stolen by ransomware groups is helping to fuel business email compromise (BEC) attacks, according to new research.  
8th August 2022
One in three organisations experience weekly ransomware attacks
A new report has revealed that one in three organisations in the UK and the US are affected by a ransomware attack at least once a week, with almost 10% experiencing them more than once a day.  
1st August 2022
Data breach costs reach record levels
A new report has revealed that the average cost of a data breach around the world is now $4.35m. As an increase of almost 13% compared with 2020, this creates a new record.  
25th July 2022
Enterprises failing to plan for supply chain threats
A new report highlights that enterprises are failing to plan effectively for supply chain risks and cyber security threats.