Incident Response
A clear start when the situation is not.
You do not need a complete account of the incident before contacting us. We start with what you know, discuss the help you need, and clarify scope, availability, and responsibilities before work begins.
01
Contact us with what you know now.
You do not need a complete explanation before asking for help. For an active cyber incident, call DFI; existing retained clients should use their agreed activation contacts. Tell us when the concern was discovered, what services or accounts are affected and who is coordinating the response. Keep credentials and confidential evidence out of public forms and initial booking notes.
02
Establish the responsible people and immediate priorities.
We identify the organization and authorized contact, the available IT or MSP support and any counsel or insurer already involved. We ask about actions taken, critical services and urgent decisions. This discussion helps determine the relevant specialist work and whether other responsible people need to participate before technical actions are agreed.
03
Confirm availability and engagement arrangements.
Scope, authority, commercial terms and response arrangements must be confirmed before work begins. An inquiry or website submission does not reserve response capacity or create an engagement. If an existing BreachReady agreement applies, the agreed activation process and included-hour arrangements govern the next steps; we do not infer them from an assessment or previous conversation.
04
Agree secure access and a coordinated way of working.
We establish how evidence and access will be provided, who can approve changes and how findings will be communicated. We coordinate with the people who operate your systems so collection, containment and restoration do not proceed on conflicting instructions. Sensitive data and credentials are shared only through the agreed arrangements, not through the public website.
05
Refine the scope as the facts develop.
Early findings can change the systems, time period or questions that need investigation. We explain material limitations and further work needed so your authorized contact can make informed decisions. Reporting should distinguish preliminary observations from completed findings and identify what remains with your organization, technical providers or advisers.
RELEVANT SOURCES
Start with what is available.
We help you identify which available sources can answer your question, within an authorized scope.
Initial incident descriptionBEFORE WE BEGIN
Here is what helps us understand your matter.
- Call for an active incident; retained clients should use agreed activation contacts.
- Prepare a short description, discovery time and affected-service list.
- Identify the authorized decision-maker, IT/MSP contact and relevant advisers.
- Record actions already taken without sending credentials or sensitive evidence through the website.
URGENT BREACH & RANSOMWARE RESPONSE
Know what to expect.
Make the next decision with clarity.
When your organization faces an urgent breach or ransomware incident, clear response arrangements matter. Our service and fee guide explains how DFI prioritizes your incident, what the initial fee covers and how further work is billed.
- High-priority specialist mobilization for new clients
- A clear initial fee and included response hours
- Transparent billing for continued support
For urgent breaches and ransomware outside BreachReady. Business email compromise is handled separately.
Incident happening now?Call +1 778-742-5621Please call rather than wait for a form response. Downloading a guide does not activate an engagement or reserve response capacity.
RELATED ARTICLES
Useful before you need us.
We share the questions and methods that can help you make a more informed next decision.
Article
Ransomware Readiness: Recovery Takes More Than Restoring Servers
Backups help you recover data, but your business needs more than restored servers. We explain how to connect virtual-server protection, tested dependencies, useful evidence and leadership decisions in your recovery preparation.
Prepare your people, decisions and specialist support for a ransomware incident, beyond backups.
Read article
Article
Business Email Compromise: Verify the Payment, Not Just the Email
A familiar email thread does not authorize a payment. We explain how trusted callbacks, independent approval and a clear fraud response can help your team verify a request before money moves.
Help your team recognize and respond to suspicious changes in payment instructions.
Read articleYOUR NEXT STEP
Bring clarity to the response.
Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.