- Home
- Incident Response & Forensics
- Crisis management
When an incident becomes a business crisis,
someone has to run it.
A serious cyber incident is never only a technology problem. We bring an experienced crisis commander, a formal command structure and crisis communications with PR counsel, and we help you build and test the framework before the day comes.
The technical response is only one front.
When ransomware stops operations or customer data is exposed, leadership has to manage continuity, stakeholders, regulators, legal exposure, media, staff and customers at once, under time pressure and with incomplete information. Your executive team is capable; most of them have simply never done this before.
Our crisis leads have, many times. We stand up a command structure based on incident command principles adapted for cyber events, run the decision log, coordinate legal, communications, operations and technical teams, and brief your executives and board on a regular rhythm. The responders handle containment; we make sure the business decisions around it are made clearly, quickly and on the record.
Before an incident, we build the crisis framework and communications playbooks with you and test them, along with continuity planning and supply-chain alternatives, so the first time your team runs the plan is not the real thing.
- An experienced crisis commander working alongside your executives
- A crisis command structure, decision log and timeline documentation
- Crisis communications with PR counsel for media, staff, customers and regulators
- Regular situation briefings for executive leadership and the board
- A crisis management framework and communications playbooks, built and tested
- A post-crisis review with updates to your plans and playbooks
During a crisis, four things happen at once.
Stand up command
We activate the crisis team, assign roles and authority, and open the decision log so every call is informed and recorded.
Coordinate
Legal, communications, operations and the technical response work from one picture, with external parties brought in on agreed triggers.
Communicate
Consistent, accurate and legally reviewed messages go to each audience at the right time, including regulatory notifications.
Recover and review
We drive the recovery sequence with business units, manage expectations on restoration, then review what worked and what needs to change.
Every statement becomesa permanent record.
Regulators, opposing counsel, journalists and customers will read everything you say. Our communications advisors work in step with your legal team so every message is accurate, defensible and on time.
Media handling
Response strategy, spokesperson preparation, press statements and FAQs drafted with legal review, and monitoring of media and social coverage throughout.
Stakeholder messaging
Board briefing material, staff notifications and updates, customer letters, partner and vendor communications, and investor messaging where it applies.
Regulatory notification
Analysis of your notification obligations and drafting for data protection authorities such as the UAE Data Office, SDAIA in Saudi Arabia and the DIFC and ADGM commissioners, sector regulators such as the CBUAE and SAMA, and international authorities where data subjects sit abroad.
Build the playbookbefore the crisis.
An incident response plan covers the technical steps. A crisis framework covers the organization: who decides, how information flows, when outsiders are told and how the business keeps running. We build it around how you actually operate, not a template.
Governance and roles
Crisis team composition and authority, incident commander and succession, functional leads, board liaison, and criteria for activating counsel, forensics, PR and your insurer.
Escalation
Severity criteria and triggers for moving from a security incident to a business crisis, escalation paths to the board, after-hours procedures and regulatory notification timelines.
Decision trees
Scenario guides for the hard calls: whether to pay a ransom, when to notify regulators, when to disclose publicly and when to involve law enforcement. They do not make the decision; they make sure it is considered and recorded.
Communications playbooks
Pre-drafted holding statements, updates and resolution messages for ransomware, data breach, insider and third-party scenarios, in versions for each audience.
Who it is for
Mid-market and larger organizations, and any business whose downtime is publicly visible: operators of critical infrastructure, financial institutions, healthcare, retail and public-facing services. Also any organization whose insurer or regulator expects a documented, tested crisis plan.
- IR retainer, responders on contract before the crisis
- Cyber war gaming, Vigriðr, executives decide under real pressure
- Service continuity, keep operating through the disruption
- Tabletop exercises and playbooks, rehearse the framework with your team
What buyers ask.
That's what our executive team is for.
They have likely never run a cyber crisis before. Ours have, many times, and we sit alongside your executives rather than replacing them. The decisions stay theirs.
We already have an incident response plan.
An incident response plan covers the technical steps. A crisis framework covers who decides, who is told and how the business keeps running. You need both, and they need to connect.
We have a PR firm. Why do we need you?
Keep them. Cyber incidents need communications that match the technical facts and the legal position as they change hour by hour. We work with your PR counsel and legal team so the message stays accurate.
How do we know the framework will hold up?
We test it. Every framework is validated through exercises at technical, executive and board level, and updated with what they reveal. For the hardest test, Vigriðr war gaming runs real ransomware in a copy of your environment.
Run the crisis, or let it run you.
Contact our incident team if it is happening now. Otherwise, talk to a crisis lead about building and testing your framework.