Incident Response Planning Workshop
Know who does what before a cyber incident.
A practical incident-response plan, decision framework and first-hour checklists built around your business.
Fixed quote based on your organisation, scenarios and testing requirements.
This service is for preparedness and planning. It is not an emergency-response hotline and does not guarantee immediate technical, forensic, legal or recovery assistance. If an incident is active, follow your current escalation process and contact the appropriate emergency, insurer, legal and technical-response providers.
Preparedness reduces confusion
The first problem is often not technology. It is uncertainty.
A useful plan gives people an agreed starting point before systems, communications and normal decision-making are disrupted.
Unclear authority
Nobody knows who leads, who can make urgent decisions or when executives must be involved.
Missing dependencies
Critical contacts, insurance details, recovery priorities and supplier responsibilities are unavailable.
Delayed action
Containment, communication, evidence preservation and recovery decisions are improvised under pressure.
What you receive
A plan designed to be used, not filed away.
The exact deliverables are confirmed in the written scope and tailored to your people, systems and operational dependencies.
Tailored incident-response plan
A practical response framework reflecting your organisation and agreed scenarios.
Roles and authority matrix
Defined leadership, decision, escalation and supporting responsibilities.
Severity and escalation model
Criteria for assessing an event and involving the appropriate stakeholders.
First-hour checklists
Concise actions and questions for the earliest stage of a suspected incident.
Contact and dependency register
Relevant internal, technical, insurance and specialist-response contacts.
Communication templates
Draft internal and external communication structures for authorised review.
Evidence-preservation guidance
General steps to reduce accidental loss of potentially important information.
Recovery priorities
Agreed business services and dependencies to consider during restoration planning.
Scenario playbooks
Response prompts for the specific incident types included in scope.
Handover and improvement roadmap
A guided review of the plan and remaining preparedness actions.
Response lifecycle
A shared framework for high-pressure decisions.
The plan provides structure and decision support. Actual response actions must be adapted to the incident and performed by appropriately authorised and qualified people.
Scenario playbooks
Prepare for incidents relevant to your business.
Your proposal identifies which playbooks are included. Common SME scenarios include:
Business email compromise
Suspicious mailbox access, payment redirection or impersonation activity.
Ransomware
Encryption, extortion, widespread system disruption or suspected lateral movement.
Cloud account compromise
Suspicious sign-ins, unauthorised rules, data access or privileged-account activity.
Lost or stolen device
Missing equipment with possible access to business accounts or information.
Suspected data exposure
Information disclosed, accessed or transferred without appropriate authorisation.
Insider event
Malicious or accidental actions involving employees, contractors or trusted users.
Supplier incident
A technology, cloud or service provider experiences an event affecting your operations.
Operational disruption
Technology failure or security activity interrupts critical business services.
Engagement process
Build, validate and rehearse the plan.
Scope
Confirm stakeholders, systems, business services, existing documents and scenarios.
Workshop
Map roles, decision authority, suppliers, escalation paths and recovery priorities.
Draft
Develop the plan, checklists, registers and agreed scenario playbooks.
Validate
Review contacts, responsibilities, dependencies and practical usability with stakeholders.
Walk through or test
Conduct the included handover walkthrough or an optional facilitated tabletop exercise.
Finalise
Deliver the agreed documents and prioritised preparedness improvements.
Shared responsibilities
Know which decisions belong to whom.
| Party | Typical responsibility |
|---|---|
| CyberCrunch | Facilitate planning, document the agreed framework and identify preparedness improvements. |
| Your leadership team | Approve authority, business priorities, risk decisions and plan ownership. |
| Your IT provider | Confirm technical dependencies and perform authorised technical response or recovery actions. |
| Legal, privacy and insurance advisers | Advise on legal obligations, notifications, policy conditions and insurance decisions. |
| Forensic or specialist responders | Provide specialist investigation, containment or recovery services when engaged. |
Commercial approach
A fixed quote before planning begins.
Pricing depends on team size, locations, systems, stakeholders, required scenario playbooks and whether a facilitated tabletop exercise is included.
Your proposal confirms:
- Stakeholders and workshops included
- Systems, business services and scenarios in scope
- Documents, checklists and registers supplied
- Walkthrough or tabletop-testing arrangements
- Expected schedule and fixed price
Emergency response, legal advice, forensic investigation and technical remediation are not automatically included.
Maintain readiness
A plan must change as your business changes.
Contacts, systems, suppliers and responsibilities become outdated. Ongoing options can keep the plan useful after the initial engagement.
Annual plan review
Refresh contacts, systems, responsibilities, scenarios and improvement priorities.
Facilitated tabletop exercise
Rehearse a realistic scenario, observe decisions and document lessons for improvement.
Cyber Protect
Use recurring security reviews, awareness activities, backup checks and reporting to support continued readiness.
Who it’s for
Useful before an incident exposes uncertainty.
No documented plan
Create a practical starting point before an urgent situation occurs.
An untested plan
Validate whether existing documentation reflects real people, systems and dependencies.
Cyber insurance preparation
Build and test preparedness where a questionnaire asks about incident response.
Supplier requirements
Strengthen readiness when customers or contracts expect a documented response process.
Microsoft 365 dependency
Prepare for identity, email and cloud-account incidents affecting daily operations.
Multiple technology suppliers
Clarify who coordinates decisions when responsibility spans several providers.
Frequently asked questions
What to know before planning begins.
Is this an emergency-response service?
No. This is a preparedness and planning engagement. Emergency technical, forensic, legal or recovery services require appropriate providers and separate arrangements.
Who owns and maintains the plan?
Your organisation owns the business decisions and is responsible for keeping contacts, systems and responsibilities current. Ongoing review services can be arranged separately.
Is a tabletop exercise included?
A handover walkthrough or tabletop exercise is included only when stated in the written proposal. Facilitated exercises can also be added or scheduled later.
Can our existing IT provider participate?
Yes. Their involvement is valuable for confirming technical dependencies, responsibilities and realistic response actions.
Do you advise on data-breach notification?
We can help identify decision points and contacts in the plan, but legal and regulatory notification advice must come from an appropriately qualified adviser.
How often should the plan be reviewed?
Review it after material changes, exercises or incidents, and on a regular schedule appropriate to your business. Contacts and supplier details should be checked more frequently.
Where should the plan be stored?
The organisation should maintain a protected, controlled copy that authorised people can access even if normal systems are unavailable. Storage arrangements should be agreed during planning.
Can CyberCrunch help after a real incident?
Any assistance depends on availability, capability and a separately agreed scope. This planning service does not promise emergency response or response times.
Related services
Connect preparedness with broader cyber resilience.
Prepare before pressure arrives
Request your Incident Response Planning Workshop.
Tell us about your team, systems, existing providers and the scenarios that concern you most. We’ll confirm the appropriate scope and fixed quote.
Recommended next step
Build an incident response plan around your business
Discuss roles, escalation, communications, evidence and recovery before an incident occurs.
Request a planning consultation