What does it mean to be BreachReady?

Readiness changes what happens next

A cyber incident puts more than technology under pressure. Systems may become unavailable, employees may be unable to work, customer commitments may slip and leaders may have to make consequential decisions with incomplete information. Lost revenue, response costs and damage to trust can continue long after the initial alert.

Being BreachReady means preparing your organization to act with specialist support already arranged, a clear response plan, practical incident playbooks and people who have rehearsed their roles. It means improving your ability to contain disruption and recover in a coordinated, evidence-informed way.

The Road to Resilience describes that journey through four levels: At Risk, Developing, Response-Ready and Resilient. These are BreachReady preparedness descriptions, not a promise that an incident cannot happen or that every incident will have a favourable outcome.

The principle is supported by NIST’s incident-response guidance: integrating response into cybersecurity risk management can reduce the impact of incidents and improve the efficiency and effectiveness of detection, response and recovery. The benefits depend on whether the preparation is actually implemented and maintained, not simply whether a plan exists. [1]

The avoidable cost of an improvised response

Without pre-engaged response specialists, the first hours of an incident can be spent finding a provider, confirming availability, obtaining approvals and agreeing an engagement. Meanwhile, the organization still has to decide what to isolate, what to preserve, who to notify and how to keep essential operations running.

Improvisation can create additional delay and mistakes. Uncoordinated changes may destroy useful evidence, leave affected systems connected or restore services before the underlying cause is understood. Unclear decision authority can slow containment. Inconsistent communications can compound uncertainty for employees, clients and other stakeholders.

These problems can increase business interruption and downtime, add emergency response and restoration costs, and extend lost revenue. Poorly handled communications or an inability to explain what happened can also put trust and reputation under greater pressure. The severity still depends on the incident, the affected systems and data, and the organization’s business circumstances.

The Canadian Centre for Cyber Security recommends preparing incident plans, identifying roles, arranging specialist assistance and testing the response. Its ransomware playbook also emphasizes the value of advance authorization to obtain help and understanding the support available through an insurer. [2]

BreachReady / Level 01

At Risk

No specialist response support, plan, playbooks or tabletop practice.

Greater exposure to avoidable delay, disruption and loss.

An At Risk organization has not established the core structure of an effective incident response. Specialist support has not been arranged, there is no usable response plan or incident-specific playbooks, and the organization has not practised putting a response into action through a tabletop exercise.

This does not mean the organization has no cybersecurity tools, or that it has already been compromised. It means that when an incident occurs, critical response decisions and relationships may have to be built under pressure.

Business interruption, financial loss and reputation harm are major concerns at this stage because avoidable uncertainty remains high. Without a prepared response, disruption can continue while the organization works out who can help and what to do next.

First priority: arrange specialist support and establish a practical response plan with named decision-makers. Then build the playbooks and practise the response.

BreachReady / Level 02

Developing

Some response foundations are in place or planned; preparedness is incomplete.

Priority specialist guidance helps reduce uncertainty.

A Developing organization has started to put the foundations in place, but some elements are incomplete, planned rather than implemented, or not yet practised. It may have an incident plan but lack tailored playbooks, or have specialist support arranged while roles and escalation procedures are still being worked through.

A particularly important improvement is priority access to an incident-response team. That may be DFI through BreachReady or a specialist service provided through cyber insurance. The organization should confirm the actual activation process, availability, scope, approvals and coverage rather than assume that holding a policy guarantees immediate assistance.

Earlier specialist guidance can reduce uncertainty, help prevent avoidable mistakes and support faster, more coordinated containment. That creates a more favourable basis for limiting disruption and financial impact than starting from scratch. However, unfinished plans and untested responsibilities can still slow the response.

Next priority: turn planned work into operational capability. Complete the plan and playbooks, confirm who can authorize decisions, and run a tabletop exercise.

BreachReady / Level 03

Response-Ready

24/7 specialist access, roles, plan and playbooks are in place. The response has been practised.

Coordinated response helps limit disruption and cost.

A Response-Ready organization has the foundations of a structured, expert-led and coordinated response in place, and has practised using them. It has arranged 24/7 access to incident-response specialists under its engagement, assigned roles and duties in an incident-response plan, and established playbooks that guide recovery and evidence preservation.

The team has also completed a simulated incident exercise, commonly called a tabletop. This is a facilitated discussion of a realistic incident: who receives the first alert, who contacts specialists, who can approve containment, what evidence must be preserved and how the organization communicates. Gaps identified during the exercise should be assigned and addressed.

The expected benefit is less avoidable confusion, faster informed decisions and a better-coordinated response. These capabilities can help reduce the duration of business interruption, response costs and lost revenue, and reduce the likelihood that poor incident handling compounds reputation damage.

BreachReady generally aims to establish Response-Ready foundations within 30–60 days. This is a typical program timeframe, subject to the organization’s starting point, complexity, agreed scope, participation and completion of required actions. A date on a calendar does not establish readiness; implemented and practised capabilities do.

Next priority: keep the response capability current and add targeted mitigation of common attack paths. Confirm that the specialist engagement, contacts and escalation arrangements remain active.

BreachReady / Level 04

Resilient

Practised response plus implemented threat mitigations and assessment gaps addressed.

Response capability and risk reduction are maintained.

A Resilient organization builds on an implemented and practised response strategy by adding risk reduction and mitigation of common attack paths. Within BreachReady, this includes implemented strategies for prevalent threats such as business email compromise (BEC) and ransomware, an annual network vulnerability assessment, and identified gaps addressed. BreachReady’s network vulnerability assessment is a penetration-testing engagement, not a vulnerability scan alone.

For BEC, relevant measures can include stronger account protection and a separate, trusted verification process for payment or bank-detail changes. For ransomware, examples include timely patching, restricted privileges, protected backups and tested recovery procedures. The appropriate measures depend on the organization’s environment and must be validated in practice. [2–4]

Resilient organizations have developed their response capability and reduced exposure to common threats through implemented controls. This strengthens both sides of preparedness: reducing the opportunity for an incident and being better equipped to respond if one occurs.

Resilient does not mean invulnerable. A vulnerability assessment is a point-in-time examination, and closing known gaps does not remove all risk. New systems, changing staff, evolving threats and business changes can weaken readiness. BreachReady supports maintaining this status over time through ongoing review, exercises, reassessment and follow-through on identified actions.

Ongoing priority: verify that controls work, address new findings, update plans and playbooks, and rehearse as people, systems and threats change.

Better outcomes begin before the incident

A cyber incident hits.

What is already in place changes what happens next.

An improvised response

Find and engage help

Search. Confirm availability. Agree terms.

Improvised decisions

Unclear roles can add delay and mistakes.

Disruption

More avoidable downtime

Cost

Added response cost / lost revenue

Trust

Uncertainty and reputation exposure

A coordinated response

Activate arranged support

Use a known route to specialist guidance.

Expert-led response

Coordinate containment and recovery.

Disruption

Less avoidable delay

Cost

Better control of response and loss

Trust

Clearer, coordinated communication

Illustrative pathways—not a timeline, measured loss comparison or guarantee.

Readiness is a progression in capability, not a guarantee of a particular result. Moving from At Risk to Developing reduces reliance on last-minute arrangements. Becoming Response-Ready makes the response structured and practised. Reaching Resilient adds targeted risk reduction and a commitment to maintain it.

Across that journey, the intended direction is less avoidable disruption, better control of response and recovery effort, and less harm arising from confusion or poor coordination.

The practical question is whether your organization can demonstrate the foundations: an active specialist support arrangement; clear roles and decision authority; a usable response plan; incident-specific playbooks; a completed exercise with follow-up actions; and, at the Resilient stage, implemented mitigations and vulnerability findings addressed.

A document, insurance policy or purchased service alone does not answer those questions. Readiness depends on what your team can actually do when the call comes.

How ready is your organization?

The BreachReady assessment is a practical starting point for understanding your current incident preparedness. Answer questions about your organization and receive instant readiness results and priorities based on your responses.

Use the result to identify what is already in place, what needs validation and which gaps deserve attention first. The assessment is self-reported: it is not a technical audit, proof that controls operate, or a certification. A separately prepared custom report is distinct from the instant assessment result.

Take the assessment, identify your starting point and begin your Road to Resilience with DFI Forensics.