Incident Response Readiness Assessment

Organizations should choose a readiness assessment when you need to know, “Are we ready if something happens?” An Incident Response Readiness Assessment evaluates how prepared your organization is to manage cybersecurity incidents by reviewing security controls, incident response processes, and the readiness of the security team or SOC. 

It uses your existing IR documentation, data sources, infrastructure documentation, and input from key personnel to identify gaps and improvements before an incident occurs. This service is best for organizations building or maturing their incident response program.

Choose Purple Teaming when you need to know, “Can we actually detect and stop real attacks?” It’s a collaborative exercise where red and blue teams work together in real-time to test and improve security defenses. This service is best for organizations that already have incident response foundations in place and want to stress-test them.

There are different use-cases to consider when carrying out an Incident Response Readiness Assessment:

1. If it has never been done before.
2. If you need a comprehensive action plan on how to strengthen cybersecurity within your company.
3. If you need a report for your management board to help budget for cybersecurity solutions.
4. If you have just created your own SOC.
5. If you want to an independent evaluation of cybersecurity incident response readiness and interoperation between the IT, security, and management teams.
6. If you have been onboarded by a Managed Security Service Provider. We will highlight any blind spots that should be addressed.

No. If you know exactly what you want, you can request a specific component of the service.

It depends on the agreed scope of service and can therefore range from 2 business days to 1 month.

Incident Response Readiness Assessment is designed to measure and improve a client’s readiness across 15 different incident types, including ransomware, APTs, data leaks, and more. The scope of work is similar given that security monitoring and recovery capabilities are also evaluated.

We have designed a custom scoring methodology that produces results based on several criteria. For instance, we measure coverage and quality of telemetry as an input.

Yes. We will determine whether you are collecting much more telemetry than is required to detect and respond to cybersecurity incidents.

Yes. We will require some basic understanding of your infrastructure as we can advise various improvements to the actions taken by the IR team based on the security solutions you use and your departments’ names and roles. As a result, we will provide you with a list of issues and improvements for your playbooks.

Yes. We offer a tabletop exercise called IR Game. It is powered by the web service developed by our Group-IB team and it implements a game engine where one game is one incident scenario based on in-the-wild cases that our team has handled. IR Game is an instructor-led activity. Each game consists of a specific number of moves. Every move has a new input and an open-text form to write your actions. The main goal is to develop the most effective IR plan, investigate the case, and remediate it. The game is open-book, so teams can consult their playbooks.

The game includes many different scenarios and therefore can easily be adapted to either management or technical teams.

Yes.

Yes. We can include a different course, but in such cases it will not be provided as part of this specific service.