Package 06 · Incident Response Command
“When failure
is not an option.”
Somebody is in your environment, or you think they might be, and the next few decisions will matter more than the last few years of them.
What sets the price
- Whether you hold a retainer — priority access, and the lower end of the range
- Severity, and whether it runs through nights and weekends
- Regulatory notification exposure
- How long the engagement runs
Who this is for
An organization having the worst week it has had. Executives who need someone who has done this before sitting in the chair where the decisions get made — not a vendor who will hand back a report in a fortnight.
What's actually wrong
In a real incident the technical work is rarely what goes wrong. What goes wrong is that nobody senior is deciding, the regulator clock is running, the carrier needs notice in a form nobody has drafted, and the people who should be containing the incident are instead writing status updates for executives who are also guessing.
What you get
- Containment. Stopping it, in the right order, without destroying what forensics needs.
- Forensics. What happened, how they got in, what they reached, and how confident we actually are about each answer.
- Regulator communications. Written to a clock, in the register a regulator expects.
- Carrier communications. Structured so the claim survives, which is frequently where organizations lose the most money.
- Executive command. Someone who has run this at national scale and across 75+ countries taking the calls you should not be taking.
How it runs
Engaged immediately, billed hourly. Retainer holders get priority access, which is the actual product — the day you need this, availability matters more than rate.
What this isn't
Not a retainer you buy in advance for advice; that is the Executive Advisory Retainer, and it is the cheaper way to meet. This is the fire. If you are reading this page and nothing is currently wrong, buy the priority access now and hope it stays unused.