Recover
Incident preparedness
Know who does what before something goes wrong.
We help you prepare for a cyber incident: a practical response plan, a contact tree, clear responsibilities, your insurer and IT provider escalation details in one place, and checklists your team can follow. We then test it with tabletop exercises based on realistic scenarios. This is preparation, not an emergency response service. If you have an incident under way now, contact your IT provider and, if you hold cyber insurance, your insurer as your policy directs.
Request a quote- Price
- Quoted on scope
- How you can engage us
- One-off project
- Delivered by
- Cyber Guys
Who it is for
Businesses that want their team to know what to do, and who to call, if an account is compromised, a payment is diverted or systems are encrypted.
Scope
Your incident response arrangements across the people, suppliers and systems agreed in the scope.
What is included
- An incident response plan written for your business
- A contact tree covering staff, your IT provider, insurer, and other parties you name
- Responsibilities for decisions, communication and technical response
- Insurer and IT provider escalation details recorded in one place
- Guidance on preserving evidence so it is available to investigators and your insurer
- Checklists for common incidents
- Tabletop exercises using scenarios such as a compromised Microsoft 365 account, ransomware, a fraudulent payment, a lost device, accidental disclosure of personal information and AI-assisted impersonation
- An exercise findings report and tracked follow-up actions
What is not included
- Work outside the agreed scope, which is quoted separately
- Emergency or on-call incident response
- Investigating or responding to a live incident
- Legal advice, including on notification obligations
- Negotiating with insurers or third parties on your behalf
How delivery works
- 01
Gather
We collect your contacts, supplier and insurer details, existing procedures and the systems that matter most.
- 02
Agree roles
We agree who decides, who communicates and who handles the technical response for each type of incident.
- 03
Write the plan
We write the plan, contact tree and checklists in plain English, sized for your business.
- 04
Exercise
We run tabletop exercises with your team on the agreed scenarios and record what worked and what did not.
- 05
Follow up
We update the plan from the findings and track follow-up actions.
Who does what
You
- Provide current contact, supplier and insurer details
- Name decision-makers for incident response
- Make key staff available for the tabletop exercise
- Approve and adopt the plan, and keep contact details current
Cyber Guys
- Write the plan, contact tree and checklists
- Design and facilitate the tabletop exercises
- Record findings and track follow-up actions
Your IT provider or partner
- Your IT provider confirms their escalation details and their role in a response
Access we need
- Existing policies, procedures and supplier contracts relevant to incident response
- Your cyber insurance policy details, if you hold a policy
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- Insurer escalation steps depend on your policy terms, which you or your broker confirm
What you receive
- Incident response plan
- Contact tree
- Incident checklists
- Evidence preservation guidance
- Tabletop exercise findings report
- Follow-up action list
How we know it is finished
- The plan is adopted by an authorised person
- At least one tabletop exercise has been run and its findings reported
- Follow-up actions are assigned to owners
Related services
Backup and recovery readiness
Know you can get your business back, not just that backups ran.
Quoted on scopeRequest a quoteIncident response and remediation
Coming soonStructured investigation, containment and recovery when something goes wrong.
Register interestCyber insurance readiness
Answer your insurance questionnaire accurately, with evidence behind it.
Quoted on scopeRequest a quoteEmail security and fraud protection
Make your domain harder to spoof and payment fraud harder to pull off.
Quoted on scopeRequest a quote
Request a quote for Incident preparedness
Tell us a little about your business. We will arrange a short scoping call to agree what is in scope and send a written quote. The call is about scope and price — it is not free security advice.