Incident response management: run the crisis, meet the deadlines
When an incident hits, technical teams fight the attacker. Someone else must run the crisis: decisions, reporting deadlines, the board, clients and regulators. IRM-Advisors prepares you before an incident and leads incident management during one, alongside your forensic or MDR provider.
- Pricing
- Fixed price, quoted after a 30-minute scoping call.
FINMA-supervised institutions must send preliminary information within 24 hours of detecting a reportable cyberattack and a full report within 72 hours (FINMA Guidance 05/2020). Swiss critical infrastructure operators must report to the NCSC within 24 hours.
Who it is for
- FINMA-supervised institutions with reporting obligations
- Critical infrastructure operators subject to NCSC reporting
- EU-connected financial entities under DORA incident rules
- Organisations with a SOC or MDR service but no crisis process
What you receive
- An incident response plan and crisis organisation
- Reporting playbooks for FINMA, the NCSC and the FDPIC
- Crisis exercises for management and technical teams
- Senior incident management during an incident, with availability agreed in writing
- Coordination with your forensic, MDR and legal providers
- A post-incident review with lessons learned
How it works
- PreparePlan, roles, decision rights, contact lists and reporting templates.
- ExerciseTest the plan with a realistic scenario and fix the gaps.
- RespondLead incident management: decisions, reporting, communication and provider coordination.
- LearnReview what happened, close the root causes and update the plan.
Relevant credentials
Frequently asked questions
Do you provide 24/7 incident response?
No. IRM-Advisors is led by one senior consultant. Availability and response times are agreed in writing in the retainer. For round-the-clock containment and forensics, Daniel works alongside your MDR or forensic provider and can help you choose one.
What is the difference between incident response and incident management?
Incident response is the technical work: containment, investigation and recovery. Incident management is running the whole event: decisions, legal and regulatory reporting, and communication with the board, clients and staff.
When must a FINMA-supervised firm report a cyberattack?
Under FINMA Guidance 05/2020, preliminary information is due within 24 hours of detecting a reportable attack and a full report within 72 hours. Data breaches may also need to be reported to the FDPIC under the revFADP.
Discuss your situation in a 30-minute call. No preparation needed.
Book a call