What does an incident response team do?

An incident response team (IRT) or computer incident response team (CIRT) or is a group of experts responsible for responding to, managing and mitigating security incidents. An incident response team investigates, analyses and remediates incidents and manages internal and external communications in the event of an attack. Its role can also include developing and maintaining an incident response plan and assessing potential changes in technology, training and other aspects following a security incident. Another important role for incident response teams is running trials of an organization’s incident response approach based around real-world scenarios.

What is an incident response plan?

An incident response plan is a document which outlines an organization’s strategy for responding to security incidents, such as data breaches and ransomware. It sets out specific actions and procedures to facilitate timely and effective incident mitigation, clearly defining the steps that should be taken and the person responsible for them. An incident response plan covers each stage of an incident, to enable organizations to take timely and effective action in the event of disruption caused by a cyber-attack.

Why do you need an incident response plan?

Incident response planning plays a critical role in helping organizations to maintain a robust long-term security posture. Vital time can be lost in establishing a strategy after an incident occurs. An incident response plan helps organizations to reduce the potential damage of a cyber incident and move forward quickly and effectively following an attack. Your incident response plan is a strategic roadmap which outlines the exact steps your organization should follow after different types of incidents. It also communicates to stakeholders and regulators that your organization is fully committed to addressing new and emerging cyber threats.

What should an incident response plan include?

An Incident Response Plan is a document which sets out an organization’s strategy for responding to different types of security incidents, including ransomware attacks, IP theft and data breaches. It should include the specific procedures and responsibilities associated with addressing each stage of an incident, with defined roles for completing specific incident response actions. An incident response plan is your organization’s roadmap for taking timely and effective action in the event of disruption caused by a cyber-attack.

What is an incident response plan?

A key error which organizations make in relation to incident response is failing to implement an incident response plan to effectively manage and mitigate cyber incidents such as data breaches and ransomware. Another common mistake made by many organizations is failing to understand their on-premises and cloud environments, and the security tools and policies they have in place. Failing to invest enough in an effective strategy is also a common incident response error. With back-ups a vital part of defending an organization against the impact of a cyber incident, not reviewing them regularly is yet another common mistake.

What are the key cyber incident response steps?

Effective incident response should include six key steps: preparing systems and procedures, including the development of an incident response plan the identification of incidents and the gathering of evidence the containment of attackers and incident activity to limit any additional damage from the incident, which includes short-term containment, system back-up to preserve evidence, and long-term containment the eradication of attackers and re-entry options recovery from incidents, including the restoration of systems lessons learned and the application of feedback to the next round of preparation.

How should organizations respond to a security incident?

It is important to take fast, decisive action when a security incident occurs. Effective incident response requires a clear plan which outlines the actions key stakeholders should take in a variety of scenarios. Organizations should then follow a clear and structured sequence of steps to ensure that every aspect of managing and mitigating the incident is covered. This will include actions such as containment, threat removal and mitigation and recovery, identification of improvements and further testing. The response should also include informing the relevant authorities, depending on the nature of the incident.

What is the key to effective incident response?

The key to effective incident response is good planning and preparation. Having a robust incident response plan in place with clear responsibilities for specific team members will allow your organization to respond quickly, and take immediate, decisive action to reduce the impact of different types of cyber incidents. A proactive approach which includes a structured plan set in place before a cyber incident occurs will ensure that your organization is more able to recover, even in the event of a serious cyber incident. Another important aspect of effective incident response is ensuring that you have a good security partner.

Can Kroll help with physical incidents, including workplace violence and active assailant threats?

Kroll’s Enterprise Security Risk Management team provides end-to-end threat mitigation services to help organizations plan for and navigate unforeseen physical threats. Our multidisciplinary team i comprises former federal, state and local law enforcement officials who draw from decades of on-the-ground experience. Click here for more details .

24x7 Incident Response

Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.

Kroll Cyber Risk experts respond to over 3,000 security events every year. We manage incidents of all types, complexity and severity for organizations across diverse industries. You can count on Kroll’s unique frontline experience not only in a crisis, but also for proactive planning and mitigation strategies.

We are among the top service providers preferred by major cyber insurance companies and offer client-friendly incident response retainers for peace of mind.

Explore Cyber and Data Resilience

Digital Forensics Services

Incident Remediation and Recovery Services

Incident Response Tabletop Exercises

Get a Quote

24X7 Hotline

Fast and Efficient Deployment via Onsite and Remote Incident Response Capabilities

Whether your incident is the result of a malicious hacker or accidental exposure by an employee, Kroll can help now. Our global network of certified security and digital forensic experts can deploy remote solutions quickly and/or be onsite within hours to help you contain the situation and determine next steps.

Our incident response investigations follow the Kroll Intrusion Lifecycle, a step-by-step guide to the attack patterns our experts have observed through thousands of investigations each year.

Kroll is a leading provider of end-to-end cybersecurity, digital forensics and breach response services, and will help you make informed decisions at every stage, from proactive preparation to consumer notification and remediation. Our goal, working alongside your counsel and insurance carrier, is to smoothly guide you to recovery — one that leaves you standing in the best defensible position, reputation intact, and where business can proceed with minimal disruption.

Kroll Intrusion Lifecycle

Loading component...

Common Threats Addressed by Our Incident Response Team
Business Email Compromise and Wire Fraud	Insider Threats and Accidental Data Loss
Advanced Persistent Threats (APT)	Third Party and Vendor-Related Risks
Malware, Keyloggers, and Backdoors	Cryptocurrency Theft
Ransomware	Targeted Intellectual Property Theft
Payment Card Fraud (PCI/PFI)	Web Application Attacks and Password Theft

Loading component...

Kroll Offers a Continuum of Services for the Multifaceted Nature of Incident Response

Incident Response Planning: Enhance your organization’s ability to respond to cyberattacks with Kroll’s wide range of assessments, tabletop exercises and intelligence.
Intelligent Endpoint Detection and Response: Employing a powerful combination of technology and people, this sophisticated solution enables you to detect and respond swiftly to credible threats.
Cyber Threat Intelligence: Our team aligns Kroll’s technical threat intelligence, analytical research and investigative expertise to improve visibility and effectively hunt and respond to threats.
Data Collection and Preservation: In the event of an investigation or litigation, Kroll offers cost-effective solutions to identify, isolate and preserve electronic data using forensically sound methodologies.
Data Recovery and Forensic Analysis: Kroll’s investigators are among the most knowledgeable subject matter experts practicing today; whether data was intentionally deleted or manipulated, they are able to analyze the clues left behind to quickly and defensively uncover critical information.
Malware and Advanced Persistent Threat Analysis and Remediation: Kroll’s forensic experts analyze malware to determine how it works and identify the scope of impact on your systems.

PHI and PII Identification: By providing you with a master notification list that clearly identifies the types of PHI or PII involved, we can help you avoid costly over-notification while still delivering targeted messages and remediation services to those affected.
Data Breach Notification Services: Protect your brand and reestablish trust with the individuals impacted by a data loss by matching the response to the harm caused by a breach.
Incident Remediation and Recovery Services: Expedite system recovery and minimize business disruption, with services including device and server reimaging, active directory rebuilding, network segmentation, hardware upgrades or replacements, patch management and network hardening.
Strategic Communications: Deftly navigate a host of risk and reputational landmines caused by a cyber crisis with a full suite of strategic communications support for incident response, preparedness and training.
Malware Analysis and Reverse Engineering: Further understand any code-related event through our in-depth technical analysis of benign and malicious code.

Loading component...

Benefit From Client-friendly Incident Response Retainers

Includes proactive and reactive services
No loss of money at end of term
No required use of Kroll tools or applications

Start Now

No automatic renewals or price accelerations
Includes data response services that are core Kroll capabilities (e.g., Notification, Call Center, Monitoring and Consumer Restoration)
Key cyber insurance relationships, including some of the biggest underwriters in the world

Loading component...

Kroll in Action

Containment and Remediation of Cyberattack That Compromised Personally Identifying Information (PII)

Client: Major Company in U.S. Transportation Industry

Client Problem

The client contacted Kroll late on a Friday afternoon that it had suffered a cyberattack. The organization, which served a large national and international clientele, needed to contain and remediate the incident. It also would need to notify persons whose PII had been compromised and report the incident to regulators.

How Kroll Resolved The Problem

Kroll deployed a response within two hours and had personnel onsite at the client’s headquarters by the next morning. The team eventually scaled from two investigators to 12 within 48 hours over the weekend.
Upon identifying specific indicators of compromise (IOCs), we were able to eradicate the actor and establish containment; we also provided ongoing monitoring of the containment strategy to help assure effectiveness.
We created a disposition matrix, whereby we cross-referenced compromised machines with compromised individuals’ data.

Outcome

Our investigators were able to restore the client’s system with minimal disruption to its operations. Additionally, the findings of our disposition matrix enabled the client to refine its notification list with pinpoint accuracy.

Consequently, instead of implementing costly blanket notification (which also often generates intense media coverage), the client was able to notify and address the concerns of a much smaller subset of affected persons. The client ultimately not only dramatically reduced its notification and remediation costs, but also was able to provide regulators with precise details of the incident’s scope and effects.

Loading component...

Fortify Your Response Capabilities

Threats are growing in volume and sophistication and come from multiple directions. Leverage the frontline experience of our incident response and digital forensics team for multifaceted and confident response anywhere, anytime.

Looking for Business Continuity/Disaster Recovery Solutions?

Disruptions can happen anywhere, anytime. As threats grow in the digital sphere, organizations remain vulnerable to onsite attacks, including natural disasters, workplace violence and a range of other physical threats. A well-structured business continuity and disaster recovery plan emphasizes the safety of employees, security of data and the quick recovery and maintenance of essential functions. Reach out to our business continuity experts to develop a comprehensive plan for unforeseeable events that could affect your business.

Loading component...

The State of Cyber Defense: Manufacturing Cyber Resilience

Our State of Cyber Defence in Manufacturing report provides a holistic cybersecurity overview of the manufacturing sector, including insights from threat intelligence, data breach statistics, offensive security considerations and insight into the maturity of manufacturing organizations’ cybersecurity programs.

Get your copy for more insights.

Download the Report

Loading component...

Frequently Asked Questions

Cyber incident response is the process of responding to, managing and mitigating cyber security incidents. Its goal is to limit the damage and disruption caused by cyber-attacks and, where necessary, to restore operations as quickly as possible. When an organization is impacted by a cyber security breach, a clear perspective is required to take control of the situation and respond effectively to protect assets, operations and reputation. Timely incident response support helps companies to quickly contain the compromise and smoothly achieve recovery, leaving them in the strongest position possible, with minimal business disruption and their reputation intact.

Loading component...

Connect With Us

Katherine Keefe

Global Cyber Insurance Industry LeadCyber and Data ResiliencePhiladelphia

Katherine Keefe

Colin Sheppard

Regional Managing Director, EMEACyber and Data ResilienceLondon

Colin Sheppard colin.sheppard@kroll.com +44 2070295072

Loading component...

Stay Ahead with Kroll

Data Collection and Preservation

Improve investigations and reduce your potential for litigation and fines with the strict chain-of-custody protocol our experts follow at every stage of the data collection process.

Learn More

Mobile Device Forensics

With a global mobile device forensics team and a proven track record in investigation and litigation support, Kroll enables key digital insights to be accessed quickly and securely.

Learn More

Data Recovery and Forensic Analysis

Kroll's expertise establishes whether data was compromised and to what extent. We uncover actionable information, leaving you better prepared to manage a future incident.

Learn More

Computer Forensics

Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.

Learn More

Malware Analysis and Reverse Engineering

Kroll’s Malware Analysis and Reverse Engineering team draws from decades of private and public-sector experience, across all industries, to deliver actionable findings through in-depth technical analysis of benign and malicious code.

Learn More

Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Learn More

Loading component...

News

October 18, 2024

Press Release

Kroll Appoints Katherine Keefe to Lead Global Cyber Insurance Industry Capabilities

Dave Burg, Katherine Keefe

September 19, 2024

Press Release

Kroll Becomes Relativity Gold Provider Partner

September 12, 2024

Kroll in News

Kroll Recognized in 2024 Gartner Market Guide for Digital Forensics and Incident Response Retainer Services for the Fifth Consecutive Year

Adam Malone

August 27, 2024

Press Release

Kroll Expands AI Risk Consulting Services

Loading component...

Let's solve for the future

Yes, I would like to receive periodic event invitations, reports and news from Kroll.

24x7 Incident Response

Fast and Efficient Deployment via Onsite and Remote Incident Response Capabilities

Loading component...

Loading component...

Loading component...

Benefit From Client-friendly Incident Response Retainers

Loading component...

Loading component...

Loading component...

Loading component...

Frequently Asked Questions

Loading component...

Loading component...

Loading component...

Loading component...

Let's solve for the future

We will use this information to respond to your inquiry and process your data in accordance with our privacy policy.

Loading component...

Loading component...

Loading component...

Fast and Efficient Deployment via Onsite and Remote Incident Response Capabilities

Benefit From Client-friendly Incident Response Retainers

Frequently Asked Questions

Let's solve for the future

We will use this information to respond to your inquiry and process your data in accordance with our privacy policy.

Loading component...

Loading component...

24x7 Incident Response

Fast and Efficient Deployment via Onsite and Remote Incident Response Capabilities

Loading component...

Loading component...

Loading component...

Benefit From Client-friendly Incident Response Retainers

Loading component...

Loading component...

Loading component...

Loading component...

Frequently Asked Questions

What is cyber incident response?

What does an incident response team do?

What is an incident response plan?

Why do you need an incident response plan?

What should an incident response plan include?

What is an incident response plan?

What are the key cyber incident response steps?

How should organizations respond to a security incident?

What is the key to effective incident response?

Can Kroll help with physical incidents, including workplace violence and active assailant threats?

Loading component...

Loading component...

Loading component...

Loading component...

Let's solve for the future

We will use this information to respond to your inquiry and process your data in accordance with our privacy policy.

Loading component...

Loading component...

Loading component...

Fast and Efficient Deployment via Onsite and Remote Incident Response Capabilities

Benefit From Client-friendly Incident Response Retainers

Frequently Asked Questions

What is cyber incident response?

What does an incident response team do?

What is an incident response plan?

Why do you need an incident response plan?

What should an incident response plan include?

What is an incident response plan?

What are the key cyber incident response steps?

How should organizations respond to a security incident?

What is the key to effective incident response?

Can Kroll help with physical incidents, including workplace violence and active assailant threats?

Let's solve for the future

We will use this information to respond to your inquiry and process your data in accordance with our privacy policy.

Loading component...

Loading component...