Define response responsibilities
Document who can authorize containment, approve communications, contact external responders, and make recovery decisions.
Incident response planning.
An incident response plan for your organization, with named responsibilities, escalation contacts, and scenario runbooks. A tabletop exercise helps your leadership and IT teams review decisions and identify gaps before an incident.
Deliverable
IR PLAN
Incident response, planned and rehearsed
- 1-2 weeksTypical planning window, confirmed at scoping
- Response runbooksInitial actions for agreed incident scenarios
- Tabletop exerciseA facilitated discussion with recorded findings
- PreparationNot a 24/7 emergency response service
When to use this service.
Review an existing response plan
Check whether contacts, systems, insurer instructions, and vendor responsibilities still match your environment.
Practice incident decisions
A tabletop exercise lets your team work through a scenario, identify missing information, and assign follow-up actions.
Best fit: businesses with no written response plan, or a plan that has never been practiced.
Not the right fit: organizations needing 24/7 monitoring or an on-call forensics bench; we plan and coordinate, and bring in specialist responders when live response is needed.
Included deliverables.
Incident response plan
Roles, authority, severity levels, escalation contacts, and coordination with your legal counsel, insurer, and technical responders.
Scenario runbooks
Initial response steps for agreed scenarios such as ransomware, business email compromise, or a lost device, including evidence preservation and recovery decisions.
Exercise findings
A facilitated tabletop session and written action list. A discussion exercise does not replace a technical recovery test or a live incident-response capability.
Our process.
We document the plan, exercise an agreed scenario, and update the plan from the findings.
-
Step 01
Confirm scenarios and participants
Agree the systems, business priorities, insurer instructions, participating teams, deliverables, and fee.
-
Step 02
Write the plan and runbooks
Document roles, contacts, escalation decisions, and initial response actions. Legal counsel confirms notification obligations and legal instructions.
-
Step 03
Run the tabletop exercise
Facilitate a scenario with leadership and IT. Record decisions, gaps, and follow-up actions; this is a discussion exercise, not an attack on production systems.
-
Step 04
Deliver the revised plan
Update the documents, assign action owners, and agree a review schedule. Your team distributes the plan and maintains current contacts.
Why Hardenwell.
A dedicated advisor
A named, CISSP-certified advisor leads your engagement, with specialist support where needed. Responsibilities and the agreed deliverables are documented before work begins.
No referral commissions
We do not receive referral commissions from auditors, testing firms, brokers, or software vendors. External services are identified separately so you can review their scope and fees.
A plan and exercise record
Your team receives the response documents, exercise findings, and assigned follow-up actions, with clear ownership for keeping the plan current.
Client reviews.
North American Dental Group
The report was useful, but the advisory follow-up was what made it stick. Our advisor connected the findings to the systems and data our teams rely on every day, which gave us owners instead of vague risk talk.
Heartland Dental
Some of the recommendations were simple, but they needed ownership. Their follow-up helped us assign that ownership and keep the remediation work from disappearing behind the next project.
Crinetics Pharmaceuticals
We needed the assessment to be practical in a life-sciences environment where change cannot be careless. Our Hardenwell advisor helped us prioritize the security items that mattered and move remediation forward in a controlled way.
Frequently asked questions.
No. This engagement covers planning and a tabletop exercise. For an active incident, follow your insurer's incident instructions and contact qualified responders and legal counsel. Any coordination support from Hardenwell must be separately agreed.
We review the requirements provided by your insurer and document the plan and exercise. The insurer decides whether its policy conditions are met. This engagement does not guarantee coverage or a claim outcome.
The agreed response plan, contact and escalation information, scenario runbooks, exercise findings, and follow-up action list. The scope identifies the scenarios and teams included.
Set a schedule based on your risks and applicable requirements. Review after significant changes or incidents and refresh contacts when they change. We agree an exercise and review cadence at handover.
Book your scope call.
Thirty minutes with an advisor.
We cover your organization, your deadline, and who is asking for what. You leave knowing the likely scope, the timeline, and your next step, with the price fixed in writing before any work starts.
Prefer phone or email?
(754) 216-9664 [email protected]
Do not include PHI or sensitive records in booking notes. See our Privacy Policy.