Incident Response & Resilience
Incident response and DFIR support
Incident response readiness, playbooks and tabletop exercises, plus investigation, digital forensics support and post-incident recommendations.
Key areas covered
- Readiness
- Incident response plans, playbooks, roles and tabletop exercises
- Support
- Investigation, forensics support, containment planning and recovery recommendations
- Engagement
- Fixed-scope readiness projects, or support arrangements agreed in advance
- References
- NIST SP 800-61, CERT-In reporting requirements, MITRE ATT&CK
Overview
About incident response and DFIR support
When a security incident happens, the first hours decide how much damage it does. Organisations that know who leads, what to preserve and how to contain the problem recover faster and with less disruption. Most of that work happens before the incident, not during it.
Cenvox helps you prepare with incident response plans, playbooks and tabletop exercises, and supports you through investigation, digital forensics, containment planning and recovery when an incident occurs. Availability and response arrangements are agreed in writing in advance, so you know exactly what to expect. It works alongside our managed detection and response service, which detects many incidents in the first place.
A typical starting point
You want to be ready before an incident, or you need help investigating and recovering from one.
The security problem
What goes wrong when an incident happens
No clear owner or decision-maker
Time is lost deciding who leads, who can approve shutting systems down and who talks to customers.
Evidence lost or destroyed
Rebuilding systems too quickly removes the evidence needed to understand what happened and prevent a repeat.
Incomplete containment
Removing one compromised device while the attacker keeps other access leads to repeat incidents.
Missed regulatory deadlines
CERT-In requires specified incidents to be reported within six hours of noticing them, which is hard without a plan.
Our approach
How we work through an incident
Step 1: Preparation
Plans, playbooks, contacts and logging are put in place and tested before anything happens.
Step 2: Detection and analysis
Suspicious activity is triaged to confirm whether an incident has occurred, and how far it has spread.
Step 3: Containment
We help you plan actions that stop the incident spreading while preserving the evidence you need.
Step 4: Eradication and recovery
We recommend how to remove the attacker’s access and safely restore systems and data.
Step 5: Post-incident review
A root-cause report with improvements, so the same weakness cannot be used again.
Frameworks and requirements we work with
- NIST SP 800-61
- NIST’s Computer Security Incident Handling Guide.
- CERT-In Directions (2022)
- Indian requirement to report specified cyber incidents within six hours of noticing them.
- MITRE ATT&CK
- Used to describe attacker behaviour found during investigation.
- ISO/IEC 27035
- International guidance on information security incident management.
What’s covered
What incident response support covers
Area 01
Readiness and planning
- Incident response plan and escalation structure
- Roles and responsibilities, including legal, communications and leadership
- Contact lists and out-of-hours arrangements
- Evidence preservation and logging requirements
Area 02
Playbooks and exercises
- Playbooks for common scenarios: ransomware, business email compromise, data leakage, insider misuse
- Tabletop exercises with technical and leadership teams
- Exercise reports with gaps and improvement actions
Area 03
Investigation and forensics support
- Triage of suspicious activity and alerts
- Collection and analysis of endpoint, server, cloud and log evidence
- Timeline reconstruction and scope assessment
- Indicators of compromise to search for across your environment
Area 04
Containment and recovery
- Containment planning with your IT team
- Eradication and recovery recommendations
- Post-incident review and root-cause report
- Help preparing information for regulatory reporting, such as to CERT-In
What you receive
What incident response support delivers
Incident response plan
A practical plan sized for your organisation, with roles, escalation and contacts.
Talk to us about IR readinessScenario playbooks
Step-by-step playbooks for the incidents you are most likely to face.
Tabletop exercise report
What worked, what did not, and the actions to close the gaps.
Investigation report
Timeline, scope, root cause and evidence, written for technical and management readers.
Recovery and improvement plan
Prioritised actions to restore safely and prevent a repeat.
Good to know
Response arrangements are agreed in advance
Emergency response availability, contacts, access and expectations are confirmed for each engagement. Agreeing these details in advance helps support move quickly if an incident occurs. If you are dealing with an incident now, contact us so we can assess availability and confirm the next steps.
Good to know
Detection and response work together
Incident response is far more effective when there is good detection in place. Organisations using our managed detection and response service benefit from earlier detection and better evidence when something goes wrong.
Before we start
What we need from your team
- A named sponsor and decision-maker for incident response.
- Access to relevant people from IT, security, legal, communications and leadership.
- An overview of your environment, critical systems and existing security tools.
- For investigations: access to logs, endpoint tools and affected systems, and authorisation to collect evidence.
Not sure you have everything?
We confirm exactly what incident response needs from your side during the scoping call, before any work is agreed.
Book a scoping callFAQ
Questions about incident response
Still have a question?
Ask about scope, timing or cost for incident response, even if you are not ready to commission work yet.
Contact our teamWhat is DFIR?
DFIR stands for digital forensics and incident response. Incident response is about containing and recovering from an incident; digital forensics is about collecting and analysing evidence to understand exactly what happened.
Can you help if we are dealing with an incident right now?
Contact us straight away. We will tell you honestly what support we can provide and how quickly, based on the situation. For guaranteed response arrangements, we recommend agreeing them before an incident happens.
What is a tabletop exercise?
A tabletop exercise is a guided discussion in which your team works through a realistic incident scenario, such as ransomware, step by step. It reveals gaps in plans, contacts and decision-making without any risk to your systems.
Do you report incidents to CERT-In on our behalf?
The reporting obligation stays with your organisation. We help you gather and prepare the technical information needed for the report, so it is accurate and submitted on time.
Related services
Often combined with incident response
- Managed detection and response (MDR) and endpoint securityEndpoint protection, EDR/XDR and managed response.Read more
- Security advisory and risk assessmentRisk assessments, readiness reviews and roadmaps.Read more
- Network and infrastructure penetration testing (VAPT)External, internal and Active Directory testing.Read more
Talk to us about incident response
Tell us what has prompted the conversation. We will reply to arrange a short, no-obligation scoping call for incident response.