Engaging incident response support

If an incident is happening now

Contact the team directly using the Under Attack? contact options on this website. Explain what you have observed and how the team can reach an authorised decision maker. Do not rely on the assessment or a submitted enquiry as confirmation that an incident response engagement has started.

Our incident response service covers structured investigation and digital forensics within an agreed engagement. Confirm availability and the immediate arrangements directly with the team.

Separate facts from assumptions

Record when the issue was first noticed, the services affected and the actions already taken. Explain whether the concern is an alert, a suspected compromise or a confirmed interruption. Unknowns are useful to identify; they should not be presented as established facts.

Discuss a suitable channel for sharing evidence. Do not upload passwords, personal records or investigative material through a general website enquiry. Coordinate changes to affected systems with the people responsible for the response so that recovery needs and evidence preservation can be considered together.

Establish authority and scope

Identify who can approve access, containment decisions and expenditure. Confirm the systems the provider is authorised to examine, the people they will coordinate with and any restrictions affecting the work.

An initial investigation may establish what further work is needed. Ask how additional scope will be proposed and approved. Keep responsibility for business decisions clear, including decisions about service restoration and communication with affected parties.

Understand the commercial arrangements

Ask how the work is charged, what the initial authorisation covers and when the team will review progress and costs with you. Confirm whether investigation, recovery support and a written report are included or separately scoped.

Do not assume a general website description establishes a response time, continuous availability or a recovery deadline. These depend on the engagement arrangements and the situation. Evidence may also be incomplete, so the investigation should distinguish supported findings from remaining uncertainty.

Agree what happens after the immediate response

Discuss the findings you need to receive, who can access them and how outstanding actions will be recorded. Separate urgent recovery decisions from longer term improvements. Ask your appropriate advisers to assess any legal, insurance or notification requirements relevant to the incident.

For planning ahead, read our incident preparation guide or discuss response preparation with the team. The complimentary security assessment, available at no cost, can support a general readiness discussion once there is no active incident requiring attention.

Further reading: NIST incident response recommendations.