- 01THE PROBLEMAn incident in progress and the need to contain, recover and communicate clearly.
- 02WHO IT IS FOROrganizations facing an incident or that want to prepare their response ahead of one.
- 03INTENDED OUTCOMECoordinated containment, planned recovery and communication that distinguishes facts, hypotheses and next steps.
FOR DECISION MAKERS
What changes for decision makers.
- FOR THECEOSomeone in command“In the middle of a crisis, everyone decides and nobody coordinates.”A war room with roles, cadence and status updates; the decision stays yours, with the facts on the table.
- FOR THECFOLess downtime“Every hour offline costs revenue and reputation.”Coordinated containment and recovery, starting with what the business needs back first.
- FOR THECTOA technical team with direction“The team tries to restore everything at once and erases what would be needed to understand what happened.”Contain without losing evidence, remove the cause and recover in order.
- FOR THECISOEvidence and obligations on track“Regulatory deadlines running and no reliable timeline.”Timeline, preserved evidence and support with notifications to the ANPD (Brazil's data protection authority), data subjects and authorities.
WHO JOINS THE RESPONSE
Coordinated response from alert to closure.
An incident involves technical, business, legal and communication teams at the same time. Someone needs to coordinate.
Scroll sideways to see the whole diagram
- IT and security
- Technical containment
- Executive leadership
- Business decisions
- Legal
- Obligations and evidence
- Communications
- Clients, partners and press
VISIBILITY
Status updates that separate fact from hypothesis.
During the crisis, status updates on a set cadence state what is known, what is still a hypothesis and what comes next, for the board, legal and anyone else who needs to know.
INCIDENT PHASES
From the first hour to the lessons learned.
The rush to restore cannot erase what will be needed to understand what happened.
- STAGE 01ActivateWho decides and who executes?
- STAGE 02ContainHow do you stop the spread without losing evidence?
- STAGE 03EradicateHas the cause been removed?
- STAGE 04RecoverWhat comes back first?
- STAGE 05LearnWhat changes so it does not happen again?
ANONYMIZED CASES
How this works in practice.
- Ransomware on a busy Saturday
- SITUATION
- A retail chain with dozens of stores had its operations halted by an attack while the stores were open and full.
- WHAT WE DID
- War room set up, roles and cadence defined, status updates for the board and business areas, coordination of internal teams and third parties, technical and regulatory support, and forensics when needed.
- RESULT
- The board decided with the facts on the table, and recovery followed a coordinated plan.
BEFORE AND AFTER
Preparation is part of the service.
The best response starts before the incident.
- PLANResponse written in advanceRoles, contacts and decisions defined.
- EXERCISESSimulations with the executive teamSo the first time is not the real one.
- FORENSICSWith forense.ioWhen the investigation requires forensic method.
- LGPDNotification when applicableTo the ANPD and data subjects, within the regulatory deadline.
WHAT SETS US APART
Why ness.
- 01Command, not just techniqueTechnical, business, legal and communications coordinated in a single war room.
- 02Immediate mobilizationActivation at any hour, including for those who are not yet clients.
- 03Preparation before the crisisA written response plan and exercises with the board, so the first time is not the real one.
- 04Evidence preservedThe rush to restore does not erase what will be needed to understand what happened.
- 05Obligations on trackWe always support notifications to the ANPD, data subjects and authorities.
- 06Forensics when neededforense.io steps in when the investigation requires forensic method, if engaged.
HOW IT WORKS
Stages of the work.
- 01Activation and initial assessment
- 02Coordinated containment and preservation
- 03Environment recovery
- 04Post-incident report and lessons learned
SCOPE
What is included.
Included3✓Technical coordination of the response✓Situation updates✓Final report
Subject to contract3○Activation availability○Forensic collection (forense.io)○Notification to authorities and data subjects
PEOPLE, TOOLS AND THIRD PARTIES
How we work with what you already have.
When the investigation requires forensic method, collection and specialized analysis can be conducted by forense.io.
- 01Your boardDecides based on the status updates: what to prioritize, what to communicate, what to accept.decision
- 02Your teams and suppliersCarry out containment and recovery with direction, roles and cadence set by the war room.coordinated execution
- 03Legal, DPO and communicationsHandle obligations and messaging, with the timeline and facts organized by ness.obligations and messaging
| Activity | ness. | Your team | Third parties |
|---|---|---|---|
| War room coordination | executes | — | — |
| Business decisions | supports | executes | — |
| Technical containment and recovery | coordinates | executes | supports |
| Evidence preservation | executes | supports | — |
| Status updates | executes | approves | — |
| Notification to the ANPD and data subjects | supports | executes | — |
| Post-incident report | executes | approves | — |
HOW TO ENGAGE
Three models, as set in the contract.
- MODEL 01ReadinessA retainer with activation set in the contract. Already included in n.secops.
- MODEL 02Emergency activationFor those in an incident right now, even without a prior contract.
- MODEL 03PreparationA written response plan, defined roles and exercises with the board.
FREQUENTLY ASKED QUESTIONS
What people usually ask us.
Do you serve non-clients?
Yes. In an incident, activation is accepted even without a prior contract.
How do I activate?
At any hour, through the activation button on this page. Mobilization is immediate.
Do you decide for us?
No. ness. recommends and coordinates; the decision belongs to your board.
What about notifying the ANPD, data subjects and authorities?
We always support it: what to communicate, to whom and when, with your legal team and your Data Protection Officer (DPO).
Do we need to engage forensics?
Not necessarily. forense.io steps in when the investigation requires forensic method, if you decide to engage it.
Can we prepare in advance?
Yes, and it is the best path: a response plan, defined roles and exercises with the board.