Rules
Part of Getting incident response right the first time
Incident response reviews: assess providers before signing
Incident response reviews help small businesses test written commitments, sample reports, tabletop performance, and readiness before signing a provider.
Incident response reviews are not like software reviews. The product is delivered once, under pressure, on your worst week, and the decision is made by then.
Everything useful must be gathered beforehand: what the firm will commit to in writing, a report they produced for somebody else, and a rehearsal you run with them in the room.
This page is a set of questions and one exercise. All of it can be done before signing anything.
What to take away
- Judge the engagement letter, not the sales meeting. It is the only part that binds.
- A sample report, redacted, tells you more than any reference call.
- The rehearsal is the trial. Everything else is a conversation.
The questions that separate capability from a rate card
Ask all of these in writing, and treat vagueness as an answer.
Questions to ask in writing
- Response commitment in hours and clock start
- Capacity when several clients hit same morning
- Who actually turns up and subcontracting
- What is included and what starts a new invoice
- Sign now or on the day
- What you need from us to start
- How they communicate if mail compromised
- What is handed over and who owns it
What is the response commitment, in hours, and what starts the clock?
What happens when several clients are hit by the same thing on the same morning?
Who actually turns up?
What is included, and what starts a new invoice?
Do we sign anything now or on the day?
What do you need from us to start?
How do you communicate if our mail is compromised?
What do you hand over at the end, and who owns it?
Read a sample report
Ask for a redacted report from a real engagement. A firm that cannot produce one is telling you something.
Four things to read for
- Says how they got in, not only what was found
- Timeline is specific about times
- Recommendations are three things you could do
- Reads as something you could hand to insurer
Ask whether the report includes a timeline, the systems and data in scope, evidence collected and methods used, actions taken, findings and uncertainties, business impact, recommendations, and any limitations or handoff needs. A report full of tooling names and light on sequence is a collection exercise. A report that ends with a page anyone in the business could act on is what you are buying, and it should look like the review described in incident response.
The rehearsal is the trial
Run a tabletop with the candidate present, or with your existing provider if you are assessing them. Forty minutes, one scenario, four people from the business.
Score six things:
- Whether the provider establishes who is leading and who can authorize actions.
- Whether they ask for the assets, access, and contacts they need to begin.
- Whether they distinguish triage, evidence collection, and containment support.
- Whether they explain the business tradeoffs before recommending disruptive actions.
- Whether they have a communication route that does not depend on compromised email.
- Whether they finish with documented next steps, evidence ownership, and a clear handoff.
Score six things in rehearsal
- How quickly they ask who declares and disconnects
- Whether they ask about backups in first ten minutes
- Whether they push you to insurer and lawyer early
- What they say about evidence preservation
- How they handle proposal to wipe a machine
- Whether the language is plain
The Cybersecurity and Infrastructure Security Agency publishes tabletop exercise packages you can run without writing a scenario yourself, which removes the usual reason this never happens.
Reference calls that produce something
Ask for a client of your size who had a real incident, not a client who had a good sales experience.
Reference call questions
- What did they do in the first two hours?
- How did that compare with what you expected?
- What would you want done differently next time?
- If confidential, ask shapehours, days, people
One question does most of the work: what did they do in the first two hours, and how did that compare with what you expected? A second is worth asking too: what would you want done differently next time?
Where a reference cannot be provided because of confidentiality, ask for the shape of the engagement instead: how many hours, over how many days, with how many people. Numbers without names are still numbers.
Assessing what you already have
Most small businesses are assessing an existing IT provider rather than choosing a firm. The questions are the same with one addition: what would you do if the route in turned out to be your own access to our systems?
Assessing your existing provider
- What if the route in was your own access?
- Willingness to answer matters more than answer
- Can accounts be cut off quickly?
- Can you restore from a copy predating problem?
The answer matters and the willingness to answer matters more. A provider who has thought about it will describe how they would step back and who they would bring in. One who is offended has not thought about it.
Assess your own side at the same time. Whether the accounts can be cut off quickly is a property of identity and access, and whether you can restore from a copy that predates the problem is a property of backup and recovery. No provider can supply either, and both change the length of the engagement you will pay for.
What the assessment cannot tell you
This assessment cannot tell you what you must notify, to whom, or by when. In the United States, breach-notification duties depend on the applicable state law, your industry, and your contracts; that depends on your jurisdiction. For example, California's data breach notification law is set out in California Civil Code §§ 1798.29 and 1798.82; those provisions are not a nationwide rule, and whether they apply depends on the facts and jurisdiction. Ask counsel to identify the applicable requirements rather than relying on a responder or a general guide.
For a general incident-management sequence, the United Kingdom National Cyber Security Centre's incident management collection can help with preparation, but it is not US legal guidance. If HIPAA applies, consult the U.S. Department of Health and Human Services' HIPAA Breach Notification Rule; for other duties, confirm the applicable state law with counsel.
Common questions
What should a rehearsal quote include?
Ask for a written quote for the rehearsal separately from any retainer. Have it break out preparation, facilitation, participant limits, deliverables, and whether the fee is credited toward later work. Compare that scope with what the retainer includes; a rehearsal described as free is useful only if its deliverables and terms are clear.
Should we assess more than one firm?
Two is enough, and the tabletop separates them quickly. A third rarely adds anything the first two did not show.
Is a large firm better than a small one?
Not for a small business, and sometimes worse, because you may be their smallest client on the morning everyone calls. Capacity and attention matter more than size, which is why the question about several clients at once is on the list.
What if we cannot afford any of this?
Then the free parts do most of the work: the printed page, the rehearsal you run yourself, and the reporting culture described in security compliance training. None of them costs money, and together they change more than a retainer you cannot pay for.
