What to do first
- Call us. The line is answered 24/7: 877-778-2476.
- Keep the evidence intact. Do not wipe or reinstall affected systems.
- Isolate if you can do it safely. Disconnect affected devices from the network.
- Write down what you saw. Note what happened, when, and who has been told.
What happens when you call
- We answer at any hour, every day.
- We need a signed response agreement as the call begins, so that our access, work and evidence handling are covered. We will put it in place with you at the start of the call.
- If you already have an incident response retainer, your terms are in place and we start right away.
How we help
- Digital forensics: find out what happened and what was affected
- Incident response retainer: have terms and contacts in place before an incident
- Incident response planning: know who does what before the alarm