What we can take on
What we can take on
- Incident roles and escalation paths
- Technical response runbooks
- Identity and endpoint containment considerations
- Backup and restore dependencies
- Cyber-insurance and outside-counsel coordination points
- Tabletop exercises when included in the engagement
- Emergency contact and vendor documentation
- Post-incident remediation planning
Signs it needs attention
- Everyone assumes somebody else will know what to do
- Cyber insurance has response requirements
- Critical backup and recovery dependencies are undocumented
- Leadership has never walked through a realistic incident scenario
What we pay attention to
We keep the plan operational. Who can disable an account? Who owns the firewall? Which backup should be restored first? Who contacts the insurer? Those decisions are more useful than a generic incident-response document nobody can execute.
Security responsibilities are documented. The customer should know what is monitored, which actions Orbiwest can take, which actions require approval, and how to access the relevant reporting and tools.