Incident response and ransomware readiness
Incident response and ransomware readiness assessment with clear preparation priorities
Give your response team a clearer basis for updating plans and preparing an exercise. ICA's scoped assessment reviews response responsibilities, escalation and recovery coordination, with findings and an action plan to guide improvements.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Decide what needs attention before the next exercise
Your response plan still names former employees. A ransomware concern has raised questions about who can authorize business decisions. An upcoming exercise needs a useful starting point.
This assessment is intended for CISOs, CIOs, incident response leads and COOs who need to evaluate preparedness. It helps leadership decide which plan gaps deserve attention and which coordination problems the next exercise should examine. The focus is on the decisions your people would need to make.
Follow the response across team boundaries
Agreed coverage includes response roles, escalation paths, communications and recovery coordination. The review considers how security and IT hand decisions to business leadership, and how relevant external providers fit into that process.
Ransomware readiness includes planning for disrupted communications and coordination around restoring critical services. Questions may include who takes over when the response lead is unavailable and how operational priorities reach recovery owners. Scoping identifies the business units, critical services and plans to review; it does not assume every location or system is covered.
Compare written plans with the people using them
The proposed method combines stakeholder interviews with plan review. Relevant materials may include the incident response plan, responsibility assignments, escalation criteria and communications procedures. Existing exercise records can help explain unresolved concerns.
Interviews clarify how participants understand their responsibilities. Reviewing that account alongside the documentation helps identify ambiguous handoffs and missing instructions. Findings distinguish documented arrangements from assumptions or evidence gaps.
A tabletop exercise is optional and separately defined. Its objectives, scenario and participants need agreement. The assessment itself does not conduct an active technical attack simulation.
Turn readiness findings into planning decisions
The engagement scope defines the contents and depth of four typical outputs:
Readiness findings: Document gaps in the reviewed response arrangements so leadership can see where preparedness needs attention.
Plan recommendations: Identify updates to responsibilities, escalation or coordination instructions for the people maintaining response plans.
Exercise priorities: Highlight decisions and handoffs worth examining in a future exercise. These priorities help distinguish useful objectives from scenarios chosen without a clear purpose.
Action plan: Bring recommended improvements into an order your team can use for assigning work and discussing priorities.
These outputs support planning. They do not establish that a team will perform successfully during a real incident.
Agree coverage and involve the decision owners
Scoping starts with the concern driving the assessment and the decisions the findings should support. Organization complexity, plan coverage, stakeholder participation and evidence availability affect cost and timing. A separately defined tabletop changes the engagement requirements.
Identify the response lead and people responsible for business decisions, communications and recovery. Prepare current plans and relevant exercise records. Agree appropriate access and handling arrangements for sensitive documents. Participants should be able to explain both their own responsibilities and the handoffs they depend on.
Keep preparedness separate from live response
This is a readiness review, not an emergency response service. Incident investigation, forensics and managed security operations are outside the described engagement. Active technical attack simulation also remains outside this assessment.
Recovery coordination review does not demonstrate that backups can be restored or guarantee recovery. A business continuity and disaster recovery readiness assessment addresses broader continuity planning; hands-on restoration testing needs separate scope. Physical crisis planning belongs to the separate physical-security offering. Your organization retains responsibility for implementing recommendations and maintaining its plans.
Incident response readiness questions
Who is this assessment designed for?
It suits security and operational leaders concerned about outdated plans or preparing for an exercise. A response lead can use the findings to explain gaps that require decisions beyond the security team.
Can the review focus on one business unit?
Coverage can be defined around agreed plans, services and stakeholders. Any limited boundary should still account for relevant handoffs to shared teams and providers. Findings apply to the reviewed scope.
Does the assessment include a ransomware tabletop?
A tabletop is optional and separately defined. The core method uses interviews and plan review. Exercise priorities are a typical output, but delivering those priorities does not mean an exercise has been conducted.
What determines the price and timing?
The number and complexity of plans, organizational boundaries, participant access and available evidence shape the effort. Any optional tabletop also affects scope. These details need agreement before cost and timing can be confirmed.
How does this differ from continuity readiness?
This assessment concentrates on incident response roles, escalation and coordination. Continuity readiness considers broader critical-service dependencies and recovery planning. Physical crisis planning is separate; neither adjacent offer is automatically included here.
Will ICA implement the action plan or respond during an incident?
The described outputs are findings and planning recommendations. Implementation requires your team's work or a separately agreed engagement. This assessment does not provide emergency response coverage or a recovery commitment.
Give your next plan update a clear purpose
Discuss a scoped review of your incident response and ransomware preparedness. Use documented readiness findings, plan recommendations and exercise priorities to focus the next round of preparation on the responsibilities and handoffs that need attention.
Decide what needs attention before the next exercise
Your response plan still names former employees. A ransomware concern has raised questions about who can authorize business decisions. An upcoming exercise needs a useful starting point.
This assessment is intended for CISOs, CIOs, incident response leads and COOs who need to evaluate preparedness. It helps leadership decide which plan gaps deserve attention and which coordination problems the next exercise should examine. The focus is on the decisions your people would need to make.
Follow the response across team boundaries
Agreed coverage includes response roles, escalation paths, communications and recovery coordination. The review considers how security and IT hand decisions to business leadership, and how relevant external providers fit into that process.
Ransomware readiness includes planning for disrupted communications and coordination around restoring critical services. Questions may include who takes over when the response lead is unavailable and how operational priorities reach recovery owners. Scoping identifies the business units, critical services and plans to review; it does not assume every location or system is covered.
Compare written plans with the people using them
The proposed method combines stakeholder interviews with plan review. Relevant materials may include the incident response plan, responsibility assignments, escalation criteria and communications procedures. Existing exercise records can help explain unresolved concerns.
Interviews clarify how participants understand their responsibilities. Reviewing that account alongside the documentation helps identify ambiguous handoffs and missing instructions. Findings distinguish documented arrangements from assumptions or evidence gaps.
A tabletop exercise is optional and separately defined. Its objectives, scenario and participants need agreement. The assessment itself does not conduct an active technical attack simulation.
Turn readiness findings into planning decisions
The engagement scope defines the contents and depth of four typical outputs:
Readiness findings: Document gaps in the reviewed response arrangements so leadership can see where preparedness needs attention.
Plan recommendations: Identify updates to responsibilities, escalation or coordination instructions for the people maintaining response plans.
Exercise priorities: Highlight decisions and handoffs worth examining in a future exercise. These priorities help distinguish useful objectives from scenarios chosen without a clear purpose.
Action plan: Bring recommended improvements into an order your team can use for assigning work and discussing priorities.
These outputs support planning. They do not establish that a team will perform successfully during a real incident.
Agree coverage and involve the decision owners
Scoping starts with the concern driving the assessment and the decisions the findings should support. Organization complexity, plan coverage, stakeholder participation and evidence availability affect cost and timing. A separately defined tabletop changes the engagement requirements.
Identify the response lead and people responsible for business decisions, communications and recovery. Prepare current plans and relevant exercise records. Agree appropriate access and handling arrangements for sensitive documents. Participants should be able to explain both their own responsibilities and the handoffs they depend on.
Keep preparedness separate from live response
This is a readiness review, not an emergency response service. Incident investigation, forensics and managed security operations are outside the described engagement. Active technical attack simulation also remains outside this assessment.
Recovery coordination review does not demonstrate that backups can be restored or guarantee recovery. A business continuity and disaster recovery readiness assessment addresses broader continuity planning; hands-on restoration testing needs separate scope. Physical crisis planning belongs to the separate physical-security offering. Your organization retains responsibility for implementing recommendations and maintaining its plans.
Incident response readiness questions
Who is this assessment designed for?
It suits security and operational leaders concerned about outdated plans or preparing for an exercise. A response lead can use the findings to explain gaps that require decisions beyond the security team.
Can the review focus on one business unit?
Coverage can be defined around agreed plans, services and stakeholders. Any limited boundary should still account for relevant handoffs to shared teams and providers. Findings apply to the reviewed scope.
Does the assessment include a ransomware tabletop?
A tabletop is optional and separately defined. The core method uses interviews and plan review. Exercise priorities are a typical output, but delivering those priorities does not mean an exercise has been conducted.
What determines the price and timing?
The number and complexity of plans, organizational boundaries, participant access and available evidence shape the effort. Any optional tabletop also affects scope. These details need agreement before cost and timing can be confirmed.
How does this differ from continuity readiness?
This assessment concentrates on incident response roles, escalation and coordination. Continuity readiness considers broader critical-service dependencies and recovery planning. Physical crisis planning is separate; neither adjacent offer is automatically included here.
Will ICA implement the action plan or respond during an incident?
The described outputs are findings and planning recommendations. Implementation requires your team's work or a separately agreed engagement. This assessment does not provide emergency response coverage or a recovery commitment.
Give your next plan update a clear purpose
Discuss a scoped review of your incident response and ransomware preparedness. Use documented readiness findings, plan recommendations and exercise priorities to focus the next round of preparation on the responsibilities and handoffs that need attention.