Recover from an attack

Incident readiness

The worst time to work out who to call is in the middle of an attack. Have a plan, rehearse it, and have help lined up before you need it.

Ask us about this
The risk

Most businesses first think about incident response during an incident. By then, simple questions become hard: who makes decisions, who tells customers, and who your insurance policy lets you call.

A plan that has never been rehearsed tends to fall apart on first contact with a real incident.

What it does
  • An incident response plan written for your business: who does what, and in what order
  • Tabletop exercises: a rehearsal of a realistic attack with your team, to find the gaps in the plan
  • A retainer that gives you guaranteed access to incident responders, with agreed response times
  • Pre-paid service units that can go towards planning and exercises as well as emergency response

Not sure who you would have to tell after an attack, or by when? Our guide, Do we need to report a cyber attack?, explains the UK rules and what to record from the start, and How to write an incident response plan gives you an outline to start from.

Who it's for

Businesses that want to be prepared rather than improvise, particularly those with cyber insurance, customers who ask about incident handling, or ISO 27001 plans, which expect incident management to be planned in advance.

How we supply it

Readiness services are delivered by Sophos's incident response team and arranged through us. We'll help you work out which ones are worth doing first.

What's under the hood

Sophos Security Services Retainer - and Sophos's incident readiness services, delivered by the same team that handles emergency response.

Questions
MDR Plus already includes incident response for threats on protected systems. A plan and a rehearsal are still worth having, because they cover the decisions only your business can make, such as who speaks to customers and when.
A structured walk-through of a realistic attack with the people who'd be involved, around a table or on a video call. No systems are touched; the point is to find the gaps in the plan before a real incident does.
No. A small business's plan can be short. What matters is knowing who to call and who decides, before you need to.

< Back to Recover from an attack

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

Talk to us
or
See every security area

Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us

Ask us about this