Cyber Assurance and Verification
Organizations usually discover the state of their preparation during an incident. This engagement finds the gaps first: whether you would see it, whether you could contain it, and whether you could come back.
There is a plan. It was written for an organization you no longer are, the contact list is two years old, and nobody has read it since the day it was approved.
The parts that decide an incident are not in the plan at all: who is allowed to disconnect a production system, what your IT contract obliges anybody to do at two in the morning, and whether your insurer has to be told before you act.
Each element carries its own result. The finding's state is derived from them and never typed by hand.
The log source inventory against your asset list, retention settings, and a sample export proving the events you assume are being collected actually are. Gaps here are usually not a tooling problem but an unmanaged asset nobody had on a list.
Agent coverage as a full population against the asset inventory rather than a percentage from a dashboard, the privileged account list in full, and the segmentation policy as exported. Small enough in most organizations to examine entirely.
Backup immutability and isolation as configured, the identity rebuild procedure, and the restore test record. A backup nobody has restored from is an assumption, and the record either exists or it does not.
The plan, the playbooks and the escalation tree rewritten against your systems, your suppliers and your actual reporting lines.
Bracketed placeholders nobody fills in are the standard failure. Your legal counsel, your insurer's notification number and your retained responder are named or the document is not finished.
Your IT contract and your insurance policy both change how an incident runs, and neither is usually thought of as a security document.
An out-of-hours obligation that does not exist is better discovered now than at the point of needing it.
A tabletop against the plan, on a clock, with the decisions and the elapsed time recorded.
It is the only part of readiness that cannot be established by reading, because in normal operation nobody is asked.
The findings are re-checked against evidence after the work, rather than marked closed because somebody said so.
A readiness engagement that ends at the report has established what was wrong, not that anything changed.
Readiness is usually assessed by reading the plan. The plan is the part that survives an incident least, because it describes intentions and an incident tests obligations and authority.
So this engagement reads the contracts, tests the escalation path, and puts the room through a scenario on a clock. The elapsed time per decision is the finding, and it is a sentence a board and an insurer both understand.
And it ends with verification rather than with recommendations, because the gap between a closed finding and a finding somebody intended to close is where incidents live.
A badly handled incident costs customers, renewals and standing. The technical recovery is rarely the expensive part.
Insurers set notification and handling conditions. An incident run outside them can reduce or void a claim, which is a loss nobody budgets for.
Executive attention is the scarcest resource in an incident. Knowing who can authorize what is the difference between managing one and being managed by it.
Customers and underwriters ask whether the plan has been exercised, not whether it exists. It is a yes or no, and it is checkable.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Ask it three questions: when was the contact list last checked, who is named as able to disconnect a production system, and what does your IT contract oblige anybody to do at two in the morning. If the plan cannot answer, it has not been tested.
It is part of this engagement and can also be bought on its own. Inside the engagement it runs against the documentation we have just rebuilt, which is a different exercise from running one against a plan nobody has read.
No. This establishes readiness. Responding to a live incident is a different capability with different obligations, and we would rather tell you that now than during one.
It depends on how much documentation exists and how quickly people can be assembled for the exercise, not on the size of the organization.
Retain us as your responder, monitor your environment, or sign off your insurer's requirements. We establish the position and say plainly what would close each gap.
Take the incident response plan first. It costs nothing, and filling it in tells you most of what this engagement would. If you complete it and still cannot say who is allowed to disconnect a production system, that is the finding arriving early.
Related services: Incident Response Tabletop Exercise · Cybersecurity Program Development · Phishing Simulation