Defend
Be ready before the call - not during it.
Incident response and recovery connects the decisions made during a cyber incident with the work needed to restore business operations. We help you prepare the plan, rehearse realistic situations and build a recovery approach your team can use.
Clarify who makes decisions, who takes action and which systems need to return first. Exercises turn a written plan into a conversation across your technical and business teams.
A response agreement can define the people involved, activation route, availability and work covered. The terms are established before you need to rely on them.
Readiness work and response support have different scopes. We agree the responsibilities and deliverables for the parts you need.
Before disruption
Develop practical plans, rehearse decisions and establish the recovery priorities before disruption.
A practical plan, rehearsed decisions and an improvement list.
During an agreed response
Coordinate the agreed response, help establish the facts and support containment decisions with your team.
A coordinated work plan and a record of decisions and known facts.
Returning to operation
Plan restoration around business priorities, check the agreed recovery and capture the work still needed.
Recovery records and prioritised work to address remaining risks.
Response support operates within the scope, hours and activation terms agreed in writing. Your team retains business decisions and approval of operational changes.
A backup is part of the answer. Recovery also depends on identity, infrastructure, applications and the people who confirm that a service is ready to use.
Identify the business services that matter first, the systems they depend on and the credentials, keys or external services needed to recover them.
Set the target time to restore service and the amount of data loss the business can tolerate. We help turn those objectives into a realistic test scope.
An agreed restore exercise captures what was recovered, how long it took and whether the restored service passed its checks. Unresolved dependencies stay visible.
Choose a scenario to see the questions an exercise can explore. These are illustrative exercises, adapted to your environment and the people involved.
An agreed decision route, restoration priorities and gaps to address before a real disruption.
An account-compromise playbook with clear technical and business responsibilities.
A fact-gathering and escalation process that supports informed decisions.
A dependency-aware response plan and a clearer route to business continuity.
The deliverables follow the work agreed with you. Readiness produces plans and exercise findings; a response or recovery engagement adds its own decision and validation records.
Use the activation route in your existing response agreement. A website enquiry does not activate a response or reserve availability. If you have no agreement with us and need immediate assistance, use your appointed incident responder or your insurer’s incident channel.
The agreement can cover named contacts, an activation route, availability, response targets, included work and readiness activities. We confirm these in writing, including any limits and arrangements for additional expertise. There is no site-wide response-time promise.
Yes. An incident response plan, playbook review, tabletop exercise or recovery test can be a separately scoped project. The exercise findings can help you decide what further support you need.
The people who would make or carry out the decisions: typically IT, security, business leadership and relevant operations, legal or communications colleagues. We agree the scenario, participants and objectives in advance and capture the improvements afterwards.
We help coordinate the response and the evidence handling agreed in scope. Deep digital forensics or specialist investigation may require a separate provider. Responsibilities, access and the route to that support should be defined in the response arrangements.
We can help organise the technical facts, notification checklist, responsibilities and supporting records. Your legal, privacy and regulatory advisers confirm which obligations apply, the deadlines and the content of any notification. Those decisions remain with the responsible organisation.
We agree which systems or backup sets to test, the environment, dependencies and success criteria. A restore exercise records what could be recovered, how long it took, the usable recovery point and the checks performed. Results apply to the tested scope and conditions.
No. A recovery time objective (RTO) is the target for restoring a service, and a recovery point objective (RPO) is the target for how much data loss can be tolerated, expressed as time. Tests help compare the actual result with those targets and identify dependencies or gaps.
Ransom negotiation and legal advice are outside this service. Decisions involving payments, sanctions, insurance and reporting belong with the appropriate legal advisers, insurer and response specialists. Our agreed work focuses on response coordination, readiness and recovery.
Outside an active incident, an assessment is useful when you need to compare readiness with other security priorities. A penetration test examines agreed systems for exploitable weaknesses; its findings can inform exercise scenarios. Start here when response planning or recovery is the problem you already want to address.
We agree authorised contacts, secure communication, access boundaries, storage, retention and any transfer restrictions. Evidence handling and chain-of-custody responsibilities are defined where required. Avoid sending credentials or sensitive incident evidence through the general enquiry form.
get in touch
Tell us about your security challenges and our team will get back to you with a tailored response.
contact@redvault.co.uk