Understanding incident response alternatives properly

Nobody chooses their incident response arrangement. It becomes apparent at about eleven on a Tuesday night, when somebody starts phoning people and finds out who answers. The incident response alternatives below are the realistic options for a business without a security team, from a printed page to a professional retainer, and each one is described by the moment it either works or does not.

Read them as a ladder you climb partway. Almost every small business ends up combining the first two with one of the rest.

What to take away

The printed page and the phone list

One page, printed, kept where the systems it describes cannot take it with them: who declares, who may disconnect things, who is called in what order, what may be spent without asking, and where the recovery codes live.

What it buys: the difference between people executing decisions and people making them under pressure at the worst hour.

What it leaves open: the expertise. A page tells you who to call. It does not investigate anything.

The test: hand it to somebody and ask them to reach your bank's fraud line and your insurer within five minutes, using only the page.

The content of that page is set out in incident response, and writing it is the first hour anyone should spend on this subject.

If you want a structure to fill in, NIST's Computer Security Incident Handling Guide, published as Special Publication 800-61, is the free public standard that most incident response templates are built from.

Your existing IT provider, with an agreed scope

The people who already maintain your systems, with a written answer to what they do when something is wrong.

What it buys: somebody who knows your environment and can act quickly on the ordinary cases: a compromised mailbox, a machine behaving oddly, an account that needs cutting off.

What it leaves open: most providers maintain systems and do not investigate intrusions, and the two are genuinely different skills. It also leaves open the awkward case where the provider's own access was the route in, which nobody enjoys discussing in advance and everybody should.

The test: ask them, in writing, what they would do in the first hour of a suspected mailbox compromise, and whether they are authorized to disable an account without calling you first. Cutting off an account properly is more than a password reset, as identity and access sets out, and a provider who answers only with the reset has told you where their scope ends.

Your insurer's panel

Many cyber policies name responders you are expected to use, and many require notification before you engage anybody.

Carriers that write this cover for small businesses include Chubb, Travelers and Hiscox, and the responder panel is named in the policy documents themselves.

What it buys: access to professional responders, often with the cost handled, at the moment you most need both.

What it leaves open: your freedom to choose, and your timing. Read the policy now rather than during an incident: notification periods, panel requirements and what is excluded are the three things people discover too late.

The test: find the claims number today and put it on the printed page. Then read what the policy says about costs incurred before you notify.

Whether the policy is worth holding at all is a business decision rather than a security control, and it is one to take with your own broker or adviser rather than from a general page.

A retainer with an incident response firm

A standing agreement with a firm that does this professionally, usually with a response commitment and some hours included.

Firms that sell this kind of arrangement include Mandiant, CrowdStrike and Kroll. What any of them actually commits to is in the retainer, not the website.

What it buys: expertise at short notice, and a relationship that already exists. The engagement paperwork being signed in advance removes a delay that is measured in hours on the day.

What it leaves open: cost, for a business that never needs it. And the fact that a retainer is not a presence: they arrive when called, and what happens in the first hour is still yours.

The test: ask what their commitment is, in hours, and what happens when several clients are affected at once by the same thing.

Monitored detection, bought as a service

Somebody watches your systems and tells you, or acts, when something looks wrong.

Providers such as Arctic Wolf, Huntress and Sophos sell this as managed detection and response, aimed at businesses that cannot staff a security operations center.

What it buys: the chance of finding out early rather than from a customer.

What it leaves open: the authority question, which decides whether this is useful or merely faster bad news. A provider who can only notify has sold you a quicker way to learn. Settle in writing what they may do alone: isolate a machine, disable an account, block an address.

The test: ask what they did autonomously for another client last month, and what the agreement says they may do for you.

Handling it yourself

A named person inside the business who has read the material, run the rehearsals, and knows where everything is.

What it buys: speed, context, and no waiting.

What it leaves open: depth and availability. One person is on holiday sometimes, and nobody investigates their own environment well at four in the morning after two days awake.

The test: run a tabletop without that person present and see what happens.

The ladder side by side

What is not an alternative

An antivirus subscription is not an incident response arrangement. Neither is a backup, although it is the control that most changes the outcome, for the reasons in backup and recovery. And a document nobody has read is a page, not a plan.

Reporting to law enforcement is not an alternative either, but it belongs on the page. In the United States, the Cybersecurity and Infrastructure Security Agency's guidance on reporting cyber incidents is the starting point, and the FBI's Internet Crime Complaint Center (IC3) is where fraud that has moved money is reported. Elsewhere, the equivalent national body is the place to start. Reporting does not oblige you to stop your own recovery, and where money has moved, speed matters enormously.

Breach notification is a separate duty from law enforcement reporting. Every US state has a breach-notification statute, and notice generally goes to the state attorney general or another authority the statute names rather than to the police.

Common questions

We have an IT provider. Do we need anything else?

Probably the page, certainly the conversation about scope, and possibly nothing more until the business is large enough that a day of downtime is unaffordable. The gap to check for is investigation, which most providers do not offer and do not claim to.

Is a retainer worth it for ten people?

Usually not on its own, and often yes through an insurer's panel, which is the same access without the standing fee. Ask your broker what the policy provides before buying a separate arrangement.

How do we choose between monitoring and a retainer if we can only have one?

A retainer, if the honest answer is that nobody would act on an alert during the working day. Detection without response is the more common wasted purchase, and it is the same reasoning the buying guidance in security foundations applies to security spending generally.

What should we do first, today?

Write the page. Put the bank's fraud line, the insurer's claims number and the provider's out-of-hours number on it, then check that all three are current. The United Kingdom National Cyber Security Centre's incident management collection has a workable outline if you would rather start from a template than a blank sheet.