Incident Response & Recovery (Reactive services for when an attack happens)

A proactive service where an organization pays an annual retainer to have priority access to the consultant's incident response team. When a breach occurs, the team is activated immediately to contain the threat, eradicate the attacker, and recover systems.

Key Phases (per the NIST model): Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity.