The article
Picture a Friday at 11 p.m. A manager sees that the files on the shared drive have new names, and a note in every folder asks for money. Within the hour someone has to decide whether to shut the servers down, who calls the insurer, what customers hear and who keeps the evidence. Cybersecurity incident response consulting gets those decisions made in advance, on a calm weekday, when they cost a meeting instead of a crisis.
I have been building and running software for 18 years, and since 2017 my team of 70+ specialists has delivered 150+ projects. We plan for bad days the way engineers do, with the systems, the logs and the backups in front of us. Planning is one part of everything we do in cybersecurity; the response during an attack is another. Below: what goes into a response plan, who must be told and by when, a drill script you can run next week and what the work costs.
Cybersecurity incident response consulting in one table
| What | How it works |
|---|---|
| For whom | Companies that want to be ready before an incident, not during one |
| What you get | A response plan written for your systems and your people, the roles and contacts behind it, drills that test it |
| After an incident | The order of the technical, legal and customer steps, with your counsel deciding the legal ones |
| How often to test | At least once a year, and after every big change in your systems or your team |
| Price | The first call and the rough estimate are free; the work is estimated before it starts |
| Under attack now | That is incident response, not planning: write or call at once |
What goes into the plan
A plan works when a tired person can follow it at midnight. Ours covers five things:
- Who leads, who acts and who decides. One incident lead and a deputy, and the names of the people allowed to take systems offline or speak to customers.
- First steps for the incidents you are most likely to face. Typical candidates are ransomware, a stolen email account, a lost laptop, data exposed by mistake and a breach at a vendor; a risk assessment tells you which are likely for you.
- How to keep evidence while you recover. Do not wipe or restart the affected systems, which destroys evidence; disconnect them from the network if you can. The plan also says where the logs are and how far back they go, which is the job of monitoring consulting.
- Who must be told, and by when. Customers, regulators, partners and your insurer, with a name and a deadline next to each.
- Contacts outside the company. Your insurer, your counsel, your hosting and software providers, with numbers that work at night.
One rule belongs in every plan: keep a copy off your network, printed or on a phone. A plan that lives only on the shared drive is encrypted along with everything else.
Who must be told, and by when
Deadlines turn a technical incident into a legal one. They depend on the data, the states where the people live, your industry and your contracts, so your counsel names the ones that apply and the plan writes them down.
One example from the official source. Under the HIPAA Breach Notification Rule, HHS gives a covered entity at most 60 days from the discovery of a breach of unsecured health information to tell the people it affects, and expects it to move sooner when it can; a business associate has the same outer limit to tell its client. HHS also expects covered entities to have written breach notification procedures and to train their staff on them. If you work with health data, see HIPAA compliance for the rest of that program.
We are engineers, not lawyers. We prepare the facts counsel needs - what happened, which records, whose data - and the order of steps that keeps the evidence usable.
A tabletop drill you can run next week
A tabletop exercise walks your team through a realistic incident around a table, and nothing gets switched off. The plan meets real questions, and its gaps show up in a drill instead of during an attack. In October 2026 I read the four company pages Google shows for this search: not one mentions a tabletop exercise or a drill, and only one says a word about your insurer. Four pages are a small sample, but a plan nobody has rehearsed is a document, not a response.
Here is the script I would use for a first drill. Put the people who would really be called in one room for an hour: the owner, IT, finance, whoever talks to customers and, if they will come, your counsel. Read one card at a time and ask who acts, what they do and whom they tell.
| Minute | The card | What it tests |
|---|---|---|
| 0 | Friday, 11 p.m.: a manager reports renamed files and a ransom note | Who gets the first call, and whether anyone answers at night |
| 10 | IT wants every server off; sales needs the CRM for a Monday deal | Who has the authority to take systems offline |
| 20 | The backups sit on a drive inside the same network | Whether the copies survived, and when anyone last restored one |
| 30 | A customer posts that their data appeared online | Who speaks for the company, and what they may say |
| 40 | The insurer asks what has already been done | Whether the plan has the insurer's number and knows what the policy expects |
| 50 | Counsel asks which records hold personal data and where those people live | Whether you know where your sensitive data is |
| 60 | Write down every question nobody could answer | That list is the next version of the plan |
How it goes
- A first call, free. If you need an NDA, we sign it before you share details.
- Interviews and a look at the systems: what you run, where the sensitive data lives, where the logs are kept, how backups work and who can restore them.
- The plan: roles, playbooks for your likeliest incidents, the contact sheet and the notification list agreed with your counsel.
- The drill: a tabletop exercise with the people the plan names.
- The next version: every gap the drill found closed in the plan, with the drill notes kept as proof that it was tested.
Your side: name the incident lead and a deputy, bring counsel and the insurer's contact, and give the hours for interviews and the drill.
Our work
We build and run software, so the plan covers what a policy writer would skip:
- The audit log. On RxPhoto, the photo platform for clinics where we worked on the backend, the web front end and the API behind the mobile app, an audit log lets administrators follow every user action. In an incident that log answers the first question counsel asks: who opened which record, and when.
- What visitors see. When the server behind our own site stops answering, visitors get our page instead of a bare 502 error; it is rebuilt from the live content with every release. On a bad day that page is your first statement to customers.
- What to revoke. On our projects every access and service is documented, so when a password leaks or a person leaves, there is a list of what to close instead of a guess.
- Copies that restore. Our cloud backup keeps copies in a separate cloud account and checks them by restoring them. A plan needs the same answer in writing: who restores what, and in which order.
What the price depends on
- how many systems, locations and providers the plan covers;
- how many incident types get their own playbook;
- how many people and teams take part in the drill;
- whether the plan must meet a framework you follow, such as SOC 2, HIPAA or PCI DSS;
- whether the logs and backups need work before the plan can rely on them.
The first call and the rough estimate are free; the full estimate comes before any work starts.
What stays yours
The plan, the playbooks, the contact sheet and the notes of every drill, in your company's name. If a framework you follow expects a tested plan, those notes are the proof, and compliance consulting puts them where the auditor will look.
Next to this service
Incident planning is one part of cybersecurity consulting. Disaster recovery keeps copies of whole systems ready to bring back, and a managed security lead keeps the plan current as the company changes.
Get a plan before you need it. Tell us what you run, and we reply with how we would prepare your team and a rough estimate, free; on weekdays from 9 am to 6 pm Miami time, within 30 minutes.
