Incident Status & Urgency

• Do you have an active incident right now? Options: Yes — active attacker presence suspected, Yes — critical systems down (for example, ransomware), Yes — data exfiltration suspected but systems operational, No — incident contained or historical, Unsure
• Briefly describe the single most urgent symptom or impact we should know about (one or two sentences)

Authority & Approval

• Who currently holds decision authority to approve an external incident response engagement? Options: CISO/Head of Security, General Counsel, CEO/COO, Insurance claims contact (carrier), Other
• Is there authorization already in place for an external response team to access systems (retainer, signed PO, verbal OK)? Options: Yes — standing retainer or written pre-authorization, Yes — verbal approval from decision-maker, No — not yet authorized, Unsure

Technical Scope & Sensitive Data

• Which of these system types are involved or showing suspicious activity? Options: User endpoints / laptops, Servers or databases, Cloud infrastructure (IaaS/PaaS), Email or collaboration platforms, Identity provider / Active Directory, Multiple of the above / unsure
• Does the incident involve regulated or highly sensitive data we should prioritize (select all that apply)? Options: Protected health information (PHI), Financial data or consumer PII, Payment card data (PCI), Government or classified data, No regulated/highly sensitive data, Unsure

Engagement Readiness & Timing

• Is this a retainer customer or an emergency one-off engagement? Options: Retainer in place (pre-authorized rapid response), Emergency one-off engagement (no retainer), Unsure / need guidance
• How quickly do you need an incident response team to be engaged? Options: Within 1 hour, Within 4 hours, Today (within 24 hours), This week, No immediate timeline — planning only

Quick Grounding: The Incident Snapshot

• Tell me briefly how this incident first came to your attention. Options: Automated security alert, User or employee report, Business system outage, Vendor or partner notification, Other
• In the last 24 hours, what observable symptoms have you seen on affected systems? Options: Ransom note or ransom demands, High network egress or spikes, New or unexpected admin accounts, Service outages or performance degradation, Evidence of data transfer to external hosts, Other
• When did you first notice suspicious activity, provide date and approximate time.
• Who is the single person currently coordinating the response on your side? Options: CISO or head of security, IT operations lead, General counsel, Incident response coordinator not yet assigned, Other
• Estimate how many endpoints, servers, and cloud instances you believe are affected. Options: Under 50, 50–250, 250–1,000, 1,000–5,000, Over 5,000, Unknown

Where the Attacker Actually Lives

• What single persistence mechanism or foothold do you suspect the attacker maintains today? Options: Stolen credentials or service accounts, Scheduled tasks or services, Web shell in web servers, Persisted cloud keys or roles, Unknown or multiple methods, Other
• Describe any command-and-control indicators you've captured, such as external IPs, domains, or unusual outbound connections.
• Have you observed lateral movement indicators, for example unexpected remote desktop sessions, new admin accounts, or unusual SMB or RPC activity? Options: Yes, clear indicators, Some suspicious activity, inconclusive, No indicators seen, Unsure
• List the security controls or sensors currently collecting telemetry in the affected environment. Options: Endpoint detection and response, Network packet capture, Cloud audit logs, SIEM or log aggregation, Identity provider logs, Backups and archive logs, No relevant telemetry
• If an active persistence is confirmed, what is the maximum time window you have to contain before business impact becomes irreversible? Options: Under 4 hours, 4–24 hours, 24–72 hours, More than 72 hours, Unknown

What Your Data and Systems Really Mean to the Business

• How would you rank the business criticality of the systems you believe are affected, from mission-critical to low-impact? Options: Mostly mission-critical systems, A mix of mission-critical and non-critical, Mostly low-impact systems, Unknown
• Which categories of sensitive data may be involved, select all that apply. Options: Customer personal data (PII), Payment card or financial data, Health records, Employee or HR data, Intellectual property or source code, Regulated data under law or contract, Unknown
• Approximately how many unique user records or files do you estimate could be impacted? Options: Under 1,000, 1,000–10,000, 10,000–100,000, Over 100,000, Unknown
• What percentage of your customer-facing traffic runs through the potentially affected systems? Options: Under 10%, 10–25%, 25–50%, 50–75%, Over 75%, Unknown
• Why would disclosure or compromise of the identified data categories trigger regulatory or contractual notifications for your organization?

Who Must Be at the Table Right Now

• Name the three roles inside your organization who must approve containment actions immediately. Options: CEO or executive delegate, CISO or head of security, General counsel, IT operations lead, Business unit owner, Privacy officer, Insurer contact, Other
• Confirm whether legal counsel or insurer approval is required before making configuration changes or taking systems offline. Options: Legal approval required, Insurer approval required, Both legal and insurer approval required, No approvals required, Unsure
• Which communication channels does your executive team expect to be used for incident updates? Options: Email with secure attachments, Phone calls, Secure incident portal, SMS or text for urgent notices, In-person briefings, Other
• Walk me through your escalation path for C-suite notification, including thresholds or impact levels that trigger it.
• If a forensic hold is needed, who has the legal authority to issue it and how quickly can it be enacted? Options: General counsel can issue within hours, Legal requires executive signoff, Insurer must be consulted first, No formal legal hold process, Unsure

Hidden Barriers That Slow an Emergency Response

• Where does your current approval or procurement process cause the most delay in enacting emergency containment? Options: Legal contract review, Change control board, Vendor or third-party approvals, Budget or procurement signoff, Shortage of technical personnel, No significant approval delays
• Have you experienced a recent incident where access or credentials were not handed over in time, and what happened as a result?
• Identify the third-party vendors or managed service providers who must be contacted during a response. Options: Cloud infrastructure provider, Managed detection or MSSP, Backup provider, Email or messaging provider, Identity provider, Other, None
• How resilient are your off-site backups, and have you tested recovery from them within the last 6 months? Options: Successful recovery test within 6 months, Recovery test over 6 months ago, No recent recovery tests, Backups not verified, Unknown
• Describe any contractual clauses with vendors that could prevent immediate forensic access or data transfer.

Who Else Could You Call or Keep Doing This Yourself?

• List the external response options you are evaluating or have used in the past 24 months. Options: Existing retained incident responder, Panel law firm with IR partners, Large consultancy or audit firm, Boutique incident response firm, Insurance vendor panel, Rely on internal team only, Other
• For each option you listed, what would have to go right for you to stick with it instead of changing vendors?
• Has anyone on your executive team formally proposed handling this incident entirely in-house? Options: Yes, proposed by IT leadership, Yes, proposed by security team, No formal proposal to keep it in-house, Undocumented suggestion only
• Name one capability the incumbent or your internal team would need to demonstrate to keep your business from engaging an outside firm. Options: Faster containment time than external option, Forensic proof attacker is removed, Integrated threat intelligence correlation, Regulatory-safe breach reporting, Clear recovery timeline and guarantees, Other
• Approximately how long are you willing to wait for a first remote or on-site engagement from an external responder before considering internal containment only? Options: Under 2 hours, 2–4 hours, 4–8 hours, 8–24 hours, Longer than 24 hours

Operational Readiness and Practical Gates

• Confirm whether your team can provide administrator-level access to affected endpoints and cloud control planes within 4 hours. Options: Yes, access available within 4 hours, Yes, but access will take more than 4 hours, No, cannot provide admin-level access quickly, Unsure
• Identify the network segments, cloud accounts, or VPCs we must prioritize for sensor deployment. Options: Production web tier, Database or datastore layer, Authentication and identity systems, Admin workstations and bastion hosts, Backup environment, Development or staging
• Do you have legal holds, preservation notices, or regulatory gates that would limit forensic collection or cross-border data transfer? Options: Yes, legal hold in place, Legal hold possible and must be confirmed, No known holds or restrictions, Unsure
• Estimate the size of logs and telemetry we can retrieve for initial triage, in gigabytes per day. Options: Under 10 GB/day, 10–100 GB/day, 100–500 GB/day, Over 500 GB/day, Unknown
• Are there contractual or regulatory notification timelines that will constrain our investigation steps? Options: Yes, statutory notification deadlines apply, Yes, contractual SLA notification windows apply, Both statutory and contractual constraints, No known notification constraints, Unsure

If We Took This On, Here's What We Would Need Today

• Tell us the single most important artifact we must collect first to validate attacker activity and why.
• Provide a prioritized list of up to 10 fully qualified hostnames, IPs, or cloud instance IDs for immediate sensor targeting.
• Do you have pre-provisioned credentials, a jump-box, or emergency access method we can use to begin remote collection, and how are they delivered? Options: Pre-provisioned credentials available, Jump-box or bastion available, Credentials require rotation before use, No emergency access provisioned
• Specify any data retention or export restrictions that will affect how we store collected packet captures, disk images, or memory snapshots.
• Within what timeframe can your identity provider or authentication team revoke or rotate compromised credentials if we recommend it? Options: Immediately (minutes), Within a few hours, Same business day, Over 24 hours, Not possible without vendor assistance

Closing the Gap: Immediate Next Steps That Move the Clock

• Assuming initial triage shows active exfiltration, what is the single authorization we would need to proceed to containment within your organization? Options: CISO or security approval, General counsel signoff, Business unit owner authorization, Insurer pre-authorization, No additional authorization required, Other
• On a scale of 1 to 5, how comfortable is your board or executive leadership with a temporary outage of customer-facing services to stop data loss? Options: 1, 2, 3, 4, 5
• Summarize the minimum timeline you need from engagement acceptance to active containment, in hours. Options: Under 2 hours, 2–6 hours, 6–24 hours, 24–72 hours, Longer than 72 hours
• Select the outcomes that would make you sign an emergency engagement immediately. Options: Guaranteed response within agreed SLA, Immediate sensor deployment to validate activity, Legal and disclosure support included, Fixed emergency fee or capped pricing, Forensic evidence suitable for regulators and law enforcement, Other
• Finally, who should receive the initial statement of work and emergency authorization so we can meet your preferred SLA? Options: CISO or security operations, General counsel, Procurement, Board delegate or exec sponsor, Insurer contact, Other

• Response Overview & Capabilities

• Confirm the current state and its cost to your team
• You confirm the investigation scope and evidence types fully cover the systems and data you are most concerned about.
• Deliver a tailored investigation and containment plan with named owners and timelines within 24 hours of this session.
• You confirm the containment approach and its expected impact on availability are acceptable for your business priorities.
• Prove the investigation approach and timelines
• Provide a prioritized list of critical systems, system owners, and admin contacts, plus any known logging endpoints and recent back-ups.
• Prove the containment and eradication play and expected impact
• Provide primary legal and insurer contact details and any contractual notification timelines that must be met.
• You confirm the recovery timeline and the named coordination points for legal and insurer notifications meet regulatory and contractual windows.
• Prove the recovery and business continuity timeline
• You agree on immediate authorizations and the seller deliverable that will be provided after this session.
• Provide written authorization to proceed with emergency triage and sensor deployment when the engagement terms are agreed.
• Confirm coordination points with legal, insurers, and authorities
• Validate the proposed approach
• Agree immediate next steps and authorizations

• Response Overview & Capabilities, Solution Experience
• Response Overview Deck
• Response Overview Brief

• meeting
• slides
• document

• Deploy forensic sensor network
• Capture memory and volatile data
• Collect full packet capture and preserve evidence
• Acquire endpoint telemetry and disk images
• Rapid incident triage and scope determination
• Threat intelligence correlation and IOC hunting
• Attack infrastructure mapping and disruption
• Contain and isolate compromised systems
• Malware reverse engineering and IOC generation
• Malware removal and host reimaging
• Credential revocation and privilege remediation
• Data exfiltration analysis and file reconstruction
• Restore systems and validate business processes
• Deliver post-incident forensic report and evidence package
• Coordinate law enforcement and outside counsel engagement

Deploy forensic sensor network

• Specify the network segments and cloud regions where you need forensic sensors deployed (for example: corporate VLANs, DMZ, AWS us-east-1).
• Provide an estimate of endpoints by type to cover with sensors (Windows servers, Linux hosts, network appliances, OT devices). Options: Less than 100 endpoints, 100-500, 501-2,000, More than 2,000
• Identify your current Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) coverage and the integration endpoints we can use. Options: Full coverage, Partial coverage, No existing EDR/SIEM
• List any network access constraints or approved change windows that would affect sensor installation (maintenance windows, change freeze dates).
• Indicate required sensor telemetry retention and access controls for captured data (retention days, access roles, encryption at rest). Options: 7 days, 30 days, 90 days, Custom

Capture memory and volatile data

• Identify high-priority hosts for live memory capture (domain controllers, mail servers, privileged admin workstations).
• Provide preferred time windows or blackout periods when live acquisition is permitted. Options: Immediately (24/7), During business hours only, During maintenance windows
• State any legal hold or preservation orders that affect volatile data handling and chain-of-custody. Options: Yes, we have active legal holds, No legal holds, Unsure, need to confirm with counsel
• Detail available remote access methods for acquisition (management agent, console access, out-of-band KVM).
• Estimate the number of concurrent memory captures you require and the maximum acceptable duration per capture. Options: 1-5 concurrent captures, 6-15 concurrent captures, 16+ concurrent captures

Collect full packet capture and preserve evidence

• Specify the network taps, SPAN ports, or cloud packet-collection endpoints you can provide for full packet capture; include device names or tags where possible.
• Indicate the target retention period and permitted storage locations for packet captures to satisfy evidence preservation. Options: 7 days, 30 days, 90 days, Custom location
• Confirm the acceptance criteria for the packet capture evidence package, including chain-of-custody documentation and checksum method (for example SHA256). Options: Meets our chain-of-custody template, We require a custom evidence template, Provide exceptions details
• List bandwidth or storage constraints on mirror ports that could limit sustained packet collection (for example: 1 Gbps mirror, 10 Gbps mirror). Options: 1 Gbps, 10 Gbps, 40 Gbps, Other
• Decide if selective capture filters are required by subnet, IP range, or application protocol to limit scope. Options: Yes, filters required, No, full capture required, Only if storage constrained

Acquire endpoint telemetry and disk images

• Name the priority hosts for full disk imaging (for example: database servers, mail servers, key executive workstations).
• Describe available imaging methods and credentials we can use (physical access, management console, agent-based image).
• Confirm acceptable image formats and verification methods for forensic use (for example: forensic image with SHA256, E01, raw/dd). Options: Forensic image with SHA256, E01, Raw/dd, Other
• State required forensic mounting or preservation restrictions for imaged disks (read-only, air-gapped storage, encrypted archive). Options: Read-only storage, Air-gapped storage, Standard secured repo
• Estimate total disk capacity to be imaged and note any encrypted volumes that will require keys.

Rapid incident triage and scope determination

• Share the initial indicators of compromise you have observed (suspicious IP addresses, file names, ransom notes, unusual processes).
• Supply the time window for triage (from detection timestamp to now) in ISO date-time or relative hours.
• Name the business systems you want prioritized for scope (customer-facing services, billing systems, Active Directory).
• Select your acceptable triage service-level objective for initial impact assessment. Options: 30 minutes, 1 hour, 4 hours, Custom
• Clarify whether encrypted or backup systems should be excluded from immediate containment pending legal guidance. Options: Exclude backups until counsel advises, Include backups in immediate scope, Will follow counsel instructions

Threat intelligence correlation and IOC hunting

• Share any existing indicators of compromise (IOCs) you can provide now (file hashes, domains, IPs, YARA rules).
• Select the internal telemetry sources we should query for IOC hunting (EDR, SIEM, firewall logs, cloud audit logs). Options: Endpoint Detection and Response (EDR), Security Information and Event Management (SIEM), Firewall logs, Cloud audit logs, VPN logs, Other
• Choose enrichment requirements for threat intelligence correlation (for example passive DNS, whois, sandbox results). Options: Passive DNS, Whois/registration data, Sandbox behavioral results, All of the above, Custom
• Define the lookback window for IOC hunting across logs and telemetry (hours, days, weeks). Options: 24 hours, 7 days, 30 days, 90 days, Custom
• Choose whether automated blocking of matched IOCs at network or endpoint controls is permitted during hunting. Options: Allow automated blocking, Alert only, no blocking, Require approval per IOC

Attack infrastructure mapping and disruption

• Enumerate public-facing assets and domains to include in infrastructure mapping (websites, mail exchange records, VPN endpoints).
• Disclose any known attacker infrastructure indicators you already have (command and control domains, hosting providers, IP lists).
• Describe legal or policy constraints for disruption activities that could affect third-party infrastructure. Options: No constraints, Notify counsel before disruption, No disruption allowed
• Supply preferred coordination points for takedown or blocking actions (ISP contacts, registrar contacts, national computer security incident response team).
• Clarify whether you require notification templates or an approval workflow before we contact hosts or registrars. Options: Require notification templates and approval, Notification templates only, No approval needed

Contain and isolate compromised systems

• Outline the isolation methods permitted for containment (network ACLs, host quarantine via EDR, switch port isolation). Options: Network ACLs, Host quarantine via EDR, Switch port isolation, Other
• Declare systems that must remain online for business continuity and cannot be isolated (for example billing servers, telephony systems).
• Define acceptable timing for containment actions relative to executive or counsel approval. Options: Immediate (no approval delay), After CISO approval, After counsel approval
• Describe required rollback procedures in case containment causes a service outage. Options: Automated rollback, Manual rollback plan required, We accept possible outages
• Detail monitoring checks we should run to verify isolation effectiveness (for example: no outbound C2, no SMB to unknown hosts).

Malware reverse engineering and IOC generation

• Upload status of suspected malware samples for analysis (available now, available on collection, none available). Options: Samples available now, Samples will be provided on collection, No samples currently available
• Which level of analysis is required: static analysis, dynamic sandboxing, or full reverse engineering? Options: Static analysis, Dynamic sandboxing, Full reverse engineering, Custom
• Which IOC formats and delivery mechanisms do you require for signature deployment (for example YARA, Snort rule, Sigma, STIX)? Options: YARA, Snort, Sigma, STIX, CSV/IOC list, Other
• Declare whether you need obfuscated IOC variants, raw indicators, or both for deployment in your controls. Options: Obfuscated variants, Raw indicators, Both
• Flag any restricted environments where malware analysis must not send telemetry (for example: air-gapped labs, regulated data environments).

Malware removal and host reimaging

• Outline the criteria you require before a host is considered cleaned and eligible for reimaging (for example: no persistence, clean checksums, current patches).
• Recommend your preferred reimaging method for infected hosts (golden-image deployment, rebuild from scratch, restore from backup). Options: Golden-image deployment, Rebuild from scratch, Restore from backup, Hybrid approach
• Report the owner of recovery images and whether update permission can be granted to update golden images when remediations are applied. Options: You maintain images, We can update images with approval, Other - describe
• Document required malware-free validation checks post-reimaging (for example: EDR scan results, offline hash compare, SIEM reconciliation). Options: EDR scan clean, Hash verification, SIEM validation, Multiple checks required
• Are rollback plans required if reimaging affects business workflows? Options: Yes, rollback plans required, No, Only for critical systems

Credential revocation and privilege remediation

• Enumerate credential stores and identity providers in scope (for example Active Directory, cloud identity provider, single sign-on provider). Options: Active Directory, Cloud Identity / IAM, Single sign-on provider, Other
• Report privileged accounts and service accounts that require credential rotation, including any emergency elevation accounts.
• Define required password rotation policies and multi-factor authentication resets (for example force reset, rotation within 24 hours). Options: Immediate force reset, Rotate within 24 hours, Rotate within 7 days, Custom
• Are temporary disabling of accounts permitted as part of remediation? Options: Yes, temporarily disable, No, only credential rotation, Require approval before disable
• Verify whether service account credentials are stored in a secrets manager and whether access will be provided for remediation. Options: Stored and accessible with credentials we can use, Stored but not accessible, Not stored in a secrets manager

Data exfiltration analysis and file reconstruction

• Collect the list of data sources we should use for exfiltration analysis (for example proxy logs, data loss prevention logs, cloud object storage access logs). Options: Proxy logs, DLP logs, Cloud storage logs, SIEM, Other
• Prioritize sensitive data repositories to focus on for reconstruction (for example customer databases, financial ledgers, email archives).
• Recommend the acceptable reconstruction fidelity threshold (complete file recovery, partial metadata, SHA256 match). Options: Complete file recovery, Partial with metadata, Metadata only
• Document required notification thresholds if confirmed exfiltration of regulated data occurs (for example personally identifiable information, protected health information). Options: Notify counsel immediately, Notify after verification, Follow internal policy
• Do you require proof-of-possession artifacts for regulator or insurer reporting (for example hash lists, sample files) and at what level of sampling? Options: Yes – hash lists and sample files, Only hash lists, No

• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Engagement Order Form
• Service Level Agreement (SLA)
• Emergency Authorization to Proceed
• Fee Schedule & Payment Terms
• Law Enforcement & Counsel Coordination Authorization
• Data Processing Addendum (DPA) — conditional

• Closure Readout and Verification
• First Measurement, Outcomes and Gaps
• Acceptance Gate, Final Forensic Report and Closure Decision
• Quarterly Remediation Progress and Lessons Review

• Prepare a regulatory status brief for distribution to legal and insurer contacts if any open reporting items remain.
• Restate acceptance criteria and numeric targets
• Produce a documented acceptance decision for the final forensic and disclosure reports against the criteria recorded in Mutual Commit and Engagement Scope.
• Confirm that attacker removal verification is complete or document any conditional verification steps with deadlines.
• Establish the final remediation closure schedule and the evidence handoff plan for legal and regulatory teams.
• Publish the signed acceptance decision and archive the final forensic evidence package to the agreed retention location.
• Capture and circulate the final remediation schedule with dates for each remaining item and acceptance criteria for closure.
• Deliver the disclosure-ready summary and evidence bundle to counsel and insurer as agreed.
• If conditional acceptance, enumerate the conditional items and set verification dates for re-evaluation.
• Remediation progress dashboard
• Confirm remediation percent complete meets the target recorded in Mutual Commit or document the remediation runway to meet it.
• Identify and schedule remediation of any remaining high-risk residues and confirm projected close dates.
• Agree specific playbook updates and a date for the next tabletop exercise to validate improvements.
• Update the remediation tracker with the current percent complete and revised close dates for outstanding items.
• Create a prioritized list of playbook and tooling enhancements and assign implementation windows for the next quarter.
• Schedule a tabletop exercise to validate the updated playbook and monitoring configurations.
• Reconfirm scope, SLAs, and evidence retention requirements
• Confirm technical evidence supports attacker removal and list any outstanding verification work.
• Deliver a prioritized remediation action list and agree owners and target dates for immediate items.
• Confirm final forensic report delivery date and required artifacts for legal and insurer review.
• Produce and circulate the interim forensic evidence package and verification checklist.
• Schedule and perform any outstanding verification scans or telemetry correlation tasks.
• Publish the prioritized remediation action list into the shared tracker with target completion dates.
• Assemble materials required by counsel and insurer and confirm delivery method and timing.
• Present measured outcome metrics
• Determine whether mean time to attacker removal and confirmed compromised asset counts meet targets recorded in Mutual Commit, or document specific corrective actions if not.
• Ensure all high-risk remediation items have owners and closure dates that align to the acceptance gate timeline.
• Confirm regulatory disclosure readiness and identify any missing evidence needed for filings.
• Update the remediation tracker with owners, priority, and firm completion dates for all high-risk items.
• Perform targeted verification scans to close outstanding compromised-asset confirmations.
• Produce a gaps-and-mitigation brief tying each missed metric to a corrective action and timeline.
• Confirm acceptance gate meeting date and circulate the required deliverables checklist for that meeting.
• Validate attacker removal and containment evidence
• Present final forensic findings and evidence package
• Risk residue and residual exposure review
• Root-cause review for any metric shortfalls
• Demonstrate verification of attacker removal
• Regulatory, insurer, and stakeholder status update
• Remediation progress and blockers
• Review interim forensic findings and delivered artifacts
• Lessons learned and playbook updates
• Document pass/fail per acceptance criterion and capture the acceptance decision
• Disclosure and regulatory readiness check
• Present remediation action list and initial prioritization
• Agree corrective action plan and timeline to acceptance gate
• Finalize outstanding remediation schedule and disclosure handoff
• Legal, disclosure, and insurer coordination checklist
• Enhancement requests and next-quarter priorities