Incident response readiness
The first hours of an incident decide a lot. I help you prepare the tools, the procedures and the people, so that when it happens, everyone knows what to do and nobody wastes time looking for access or phone numbers.
When it makes sense
- You have no written incident response plan, or nobody has read it
- Your company falls under NIS2 and must notify significant incidents to the CCB within 24 hours
- Your cyber insurer or a large customer asks how you would handle an incident
- After an incident, to fix what went wrong in the response
- Your team has never practised a crisis together
How I work
- 01
Assessment
Where you stand today: plan, roles, contacts, logs, backups, access for responders.
- 02
Infrastructure
An isolated investigation environment and the tools ready to deploy, so the response can start without delay.
- 03
Playbooks and communication
Short, practical playbooks for your most likely scenarios, and a communication plan with backup channels if email is down.
- 04
Tabletop exercise
A realistic scenario played with your IT team and management, to test decisions under pressure.
- 05
Improvement plan
What the exercise revealed, and a prioritised list of what to fix.
What you get
- An incident response plan your team can actually use
- Playbooks for your priority scenarios (ransomware, account compromise, data leak…)
- A communication plan, with templates and backup channels
- A tabletop exercise report with concrete improvements
- A checklist for the NIS2 notification steps, if you are concerned
Why Cyber Horizon
- Plans written by someone who handles real incidents, not just templates
- GIAC Certified Incident Handler (GCIH) and Experienced Incident Handler (GX-IH)
- Experience of large-scale cyber defence exercises
- If an incident happens, the same person who prepared you can respond
Frequently asked questions
We are a small company. Is this for us?
Yes. The plan is sized to your organisation: for a small company, a few pages and a one-hour exercise already make a big difference.
Does my company fall under NIS2?
It depends on your sector, size and role in the supply chain. The CCB provides a self-assessment; I can help you read the result and prepare what it implies for incident response.
How long does it take?
From a few days for a first plan and an exercise, to a few weeks for a full programme with playbooks and infrastructure.
Can it be combined with a retainer?
Yes. Preparation hours can be part of an incident response retainer, so that the time is useful even if no incident happens.