Incident Response & Testing
Be ready before the call comes in.
An incident response plan built for how your institution actually operates, scenario playbooks for the events most likely to hit it, and facilitated tabletop exercises that rehearse both, so weaknesses surface in the conference room instead of during a breach.
Aligned to FFIEC and NIST expectations. Delivered by a US-based cyberteam.
The Problem
Most IR plans are written to satisfy an examiner. Few are written to be run at 2 a.m.
The typical incident response plan names a committee, cites a framework, and describes a process in the passive voice. It reads fine in an exam. Then ransomware hits on a Saturday morning and nobody can answer the only questions that matter: who declares the incident, who isolates what, who calls counsel, and when does the regulator clock start.
We build the plan around those questions, write playbooks for the scenarios most likely to reach a financial institution, and then rehearse them with your actual people. The rehearsal is the product: a plan that has been run, argued over, and corrected in the conference room behaves very differently from one opened for the first time during a breach.
What’s included
The plan. Then the rehearsal that makes it real.
– The Plan
Incident response plan
Roles, severity levels, escalation paths, and decision authority written in the active voice, tuned to your size and structure.
Scenario playbooks
Step-by-step playbooks for ransomware, business email compromise and wire fraud, vendor breach, and denial of service.
Notification matrix
Who gets called and when: your regulator within the 36-hour or 72-hour window, counsel, insurer, law enforcement, core processor, and customers.
Isolation standards
Pre-approved containment rules: isolate rather than power off, no restoration until forensics clears it, credentials rotated before users reconnect.
– The Rehearsal
Facilitated tabletops
Scenario-driven exercises for executive and technical teams, facilitated by our cyberteam and built from your actual environment.
Notification drills
Timed run-throughs of the notification matrix, proving the right people can be reached and the regulator decision can be made inside the window.
Playbook validation
Specific playbooks tested against scenario events to confirm they guide real action under pressure, then corrected where they don’t.
After-action & tracking
Every exercise produces findings, owners, and due dates tracked to closure, with results packaged for board and examiner review.
Outcomes
Before, during, and after. Here’s where we stand.
Before
We build and rehearse
The plan, the playbooks, the notification matrix, and the exercise program. By the time a real event hits, your team has run the scenarios and knows its parts.
During
We advise and coordinate
We support your incident commander, help coordinate counsel, forensics, your insurer, and regulator communications, and keep decisions aligned with the plan. Deep forensic investigation is performed by your retained DFIR firm; we make sure that relationship is in place before you need it.
After
We capture and improve
After-action review, corrective actions tracked to closure, playbook updates, and the board report. Every incident and every exercise leaves the program stronger.
Cadence
Rehearsal is a schedule, not an event.
Testing cadence
Semiannual
Facilitated tabletop exercise, alternating executive and technical scenarios across the year.
Annual
Timed notification drill covering the regulator window, counsel, insurer, and core processor contacts.
Annual
Playbook validation against the year’s highest-likelihood scenarios, with updates applied.
After change
Plan and matrix refresh after significant system, vendor, or personnel changes.
After incident
After-action review with corrective actions, owners, and due dates tracked to closure.
