Skip to content
CYBER

Prepare, respond and recover with confidence.

An incident plan only works if people can use it under pressure. Realistic exercises test roles, decisions, communications, supplier dependencies and recovery arrangements before a real incident exposes the gaps.

Plan an incident exercise

When clients call us.

  • “We have an incident plan, but we have never tested it.”

    Why it matters

    Roles, escalation and communication fail for the first time during the event they were meant to control.

    What you receive

    A tested plan, named decision makers and an exercise report showing what needs to change.

  • “We have backups, but we have not proved we can restore.”

    Why it matters

    A backup is a cost until it becomes a recovery, and the actual recovery time remains unknown.

    What you receive

    A witnessed restore, measured recovery time, recorded gaps and actions to make recovery dependable.

  • “Nobody is certain who makes critical decisions during an incident.”

    Why it matters

    Containment, notification and recovery stall while teams wait for authority or assume somebody else owns the decision.

    What you receive

    A decision and escalation model with named primary contacts, deputies, thresholds and communication routes.

Six decisions to rehearse.

  1. Detect

    Agree what counts as an incident and how it will be recognised.

  2. Escalate

    Confirm who must be involved and who has authority.

  3. Contain

    Decide what can be isolated, stopped or temporarily accepted.

  4. Notify

    Identify who may need to be told, by whom and against which obligation.

  5. Recover

    Set the order for restoring services and approving their return.

  6. Review

    Record what changes, who owns it and when it will be tested again.

Services in this area.

  • Incident response planning and playbooks
  • Leadership tabletop exercises
  • Ransomware readiness
  • Backup restoration and recovery validation
  • Recovery prioritisation
  • Escalation and crisis communication planning
  • Supplier incident readiness
  • Incident lessons reviews

What you receive.

  • Short response playbooks written for the people who use them
  • Decision, escalation and communication matrix
  • Exercise scenario, facilitation and findings report
  • Restore or recovery test evidence
  • Prioritised improvement plan with owners and dates

How progress is seen.

Critical decisions are rehearsed, recovery procedures are demonstrated, exercise actions close on time, and suppliers understand their role before an incident occurs.

  1. Framework relevance

    Planning and exercises can align to ISO/IEC 27001, ISO 22301, the NIST Cybersecurity Framework, the NCSC Cyber Assessment Framework, NIS2 and applicable notification or sector requirements.

  2. Service boundary

    This is readiness, exercising and recovery assurance. It is not presented as continuous monitoring or a guaranteed emergency response service unless a separate response arrangement is explicitly agreed.

Next service area

OT, IoT and Smart Building Security

Protect connected operations without unnecessary disruption.