Fee
Register to see indicative feesConfirmed in writing after scoping01 / Preparedness · Standard
Incident Response & Resilience
The question has moved from whether something will happen to what you will actually do on the day, and the plan has never been tested.
ResiliencePreparedness
Typical duration
6 to 10 weeksDepends on scenario count and the business units involvedPrimary artefact
Tested response playbooks and an exercised escalation pathPlus two moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Incident Response & Resilience is
Preparation for security incidents: playbooks built against the scenarios that would actually affect you, an escalation path with named decision-makers, and an exercise that tests both before you need them.
And what this service produces
The distinguishing feature is that it is exercised. A written plan that has never been run is a document, not a capability.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- Your incident plan is untested or absent.
- Your last incident was handled by improvisation.
- Your insurer or regulator expects documented capability.
- The board is asking what would happen on the day.
02
The usual trigger
- An incident was handled badly or slowly.
- An insurer or regulator asked for evidence of capability.
- The plan exists but has never been exercised.
- A board or audit committee has asked.
06 / The obligation
What actually fails during an incident, and why plans do not prevent it
Organisations rarely fail during an incident because they lacked a plan. They fail because the plan assumed decisions would be easy and the people making them would be available.
The decisions that stall are commercial
The decisions that stall real incidents are commercial, not technical: whether to take a revenue-generating system offline, when to notify customers, whether to involve law enforcement, what to say publicly before the picture is complete.
Executive decisions, never rehearsed
These are executive decisions with legal consequences, and they are almost never rehearsed.
Name the decision-maker, state the threshold, exercise it
The playbooks that hold are the ones that name the decision-maker for each of those, state the threshold that triggers it, and have been through at least one exercise where someone said the words out loud.
Technical response is the part organisations are usually best at. The decisions that cost weeks are commercial ones made by people who have never rehearsed making them.
07 / What you receive
Three artefacts. Each one yours to keep.
- 01
Scenario-based playbooks
Response steps for the incidents that would actually affect you, with decision points and thresholds.
Playbook setIncident manager - 02
Escalation and decision map
Who decides what, at what threshold, and who acts when they are unavailable.
Decision mapExecutive team - 03
Exercise report
What the tabletop found, what was revised, and what remains open.
ReportExecutive and board
08 / Scope
The whole system is visible before work begins.
Scenarios
- Scenarios built against your actual estate and obligations
- Blast radius and containment options
- Regulatory and contractual notification triggers
Playbooks
- Technical response steps
- Commercial decision points and thresholds
- Communications and disclosure considerations
Decision structure
- Named decision-makers and deputies
- Escalation thresholds
- Authority to act out of hours
Exercise
- One executive tabletop exercise
- Findings captured
- Playbooks revised after the exercise
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Scenarios built against your estate and obligations
- Playbooks with technical steps and commercial decision points
- A decision structure with named people and thresholds
- One executive tabletop exercise, with playbooks revised afterwards
Not included
- Incident response retainer: We do not hold a pager or respond on the day. If you need that, we will point you to a provider who does.
- Security monitoring: This is not a SOC.
- Forensics: Post-incident forensic investigation is a specialist service we do not provide.
- Ongoing exercises: One exercise is included. A recurring programme is a separate arrangement.
10 / How we do it
A traceable path from scope to evidence.
Scenario design
Scenarios built against your estate, obligations and actual dependencies.
Playbook development
Technical steps plus the commercial decision points that usually stall response.
Decision structure
Named decision-makers, thresholds, deputies and out-of-hours authority.
Exercise and revision
One executive tabletop, findings captured, playbooks revised.
Mapped againstNIST SP 800-61ISO/IEC 27035NIST Cybersecurity Framework
11 / Timeline
6 to 10 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Ready
What exists after this engagement
Scenario-based playbooks, a decision map with named people and thresholds, and one executive tabletop completed with findings closed.
Customer effort
The engagement itself runs 6 to 10 weeks.
Trigger
What activates them
A confirmed or suspected security incident meeting the thresholds defined in the decision map, which is a deliberately lower bar than "we are certain".
Customer effort
Your named decision-makers act on the thresholds.
Cadence
What keeps them current
We recommend a tabletop every six months and a playbook review annually or on material change.
Customer effort
One exercise is included here; a recurring programme is separate.
Not us
What happens on the day
Your team runs the response. We are not on call and we do not hold a pager. If you need a responder on retainer, we will point you to one and take nothing for the referral.
Customer effort
Your team runs the response.
Our work: 6 to 10 weeks
12 / Scope check
Test whether Incident Response & Resilience
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your incident readiness lead
Steve Sharma
Founder & Principal
Facilitates the executive tabletop personally. That session is the deliverable everything else supports.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
The exercise is included, not offered.
An unrehearsed playbook is a document. One executive tabletop is in the scope, not in the upsell.
We build the commercial decision points, not just the technical ones.
Taking a revenue system offline and notifying customers are the decisions that stall real incidents.
We say plainly we are not on call.
Most providers leave that ambiguous. We name it and point you to someone who holds a pager.
15 / The boundary
What this engagement does not claim.
Response
We prepare. We are not on call.
We do not hold a pager and we do not run your response.
Operations
We are not a managed security service.
We do not monitor your environment.
Forensics
We do not provide forensic investigation.
Post-incident forensics is a specialist service, and we will name providers who do it.
Frameworks
One set of playbooks, mapped across three references.
The work maps to NIST SP 800-61, ISO/IEC 27035 and the NIST Cybersecurity Framework.
What moves the fee
Per scenario in scope beyond four.
Where escalation spans several business units or entities.
Where multiple regulatory notification regimes apply.
A starting fee confirmed in writing after scopingOne executive tabletop exercise includedAdditional exercises quoted separately rather than assumed
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
20 / FAQ
The questions that change the decision.
No. We prepare; your team responds. We do not hold a pager and we would rather say so here than leave it ambiguous. If you need an on-call responder we will point you to one and take nothing for the referral.
Yes, one executive tabletop. An unrehearsed playbook is a document rather than a capability, so including it seemed more honest than offering it as an extra.
Then the useful engagement may be a single tabletop facilitation to find out whether it holds, which costs a fraction of this. We would scope that rather than rebuilding what works.
Every six months is our recommendation, and annually is the minimum that means anything. One is included here; a recurring programme is a separate arrangement.
No. Post-incident forensic investigation is a specialist service we do not provide, and we will name providers who do.
21 / Next move
If Incident Response & Resilience is what you need, the next step is a conversation about scope.
A 45-minute conversation about what your scope actually looks like, what it would cost, and whether this is the right service for you at all. With Steve Sharma, who would lead the engagement.