Managed defence
Monitoring and response if you want cover after the plan is written.
Full details →Prepare your Leicester or East Midlands organisation to detect, contain and recover from a cyber incident before one happens.
When an incident hits, the difference between a short disruption and a public crisis is usually preparation. Incident response readiness is the work of deciding, in advance, who does what, which systems matter first, and how you talk to staff, customers and insurers.
Cyber Root’s incident response readiness service reviews the plan, policies and roles you already have, then fills the gaps. We build a plan that matches the way your business actually runs, train the people named in it, and test it with a tabletop exercise so the first time you use it is not during a live attack.
This is aimed at small and mid-sized organisations in Leicester, Nottingham, Derby and the wider East Midlands that cannot justify a full in-house security team, but still need a credible answer when a customer, insurer or board asks “what happens if we are breached?”
Which threats are realistic for your size and sector, and which systems would hurt most if they stopped.
Detect, investigate, contain, eradicate and recover, written as steps your people can follow under pressure.
Who is in charge, who calls the insurer, who talks to customers, and how you reach people out of hours.
Short training for the named roles, plus the contacts, tools and evidence checklist they will need.
A facilitated scenario, such as ransomware or a stolen mailbox, that shows where the plan breaks.
We update the plan from what the exercise revealed, and agree when it should be reviewed again.
NCSC guidance is clear that organisations should know how they will respond before an incident, not during one. A written plan also supports Cyber Essentials, cyber-insurance questionnaires and supply-chain reviews. Without it, the same small team is making legal, technical and communications decisions at once, usually at the worst possible time. Readiness is not the same as a 24-hour retainer. Many of our clients start with the plan, the roles and one tabletop. A retainer, or support from our managed defence service, can be added later if you want someone on call.
We read what you already have and interview the people who would be involved.
You get a practical plan and a one-page contact sheet, not a folder nobody will open.
We run a tabletop with the real decision-makers and note the gaps.
The plan is updated, and you know what to practise next year or after a major change.
Most East Midlands clients combine more than one of these. Start with the gap that matters most.
Monitoring and response if you want cover after the plan is written.
Full details →Most incidents still start with a person clicking a link.
Full details →Help setting the risk appetite the plan is written against.
Full details →Not to start. Most SMEs get more value from a usable plan, named roles and a tabletop. A retainer is worth it if you want agreed help during a live incident.
A structured discussion of a realistic scenario. Nobody touches live systems. It shows whether people know who to call, which systems to isolate and what they are allowed to say publicly.
Yes, subject to availability and an agreed scope. We can support containment, investigation and recovery, or work alongside your existing IT provider. If you already know you want that cover, tell us before an incident so the paperwork is not the first task.
At least once a year, and again after a significant change such as a new site, a new cloud platform or a change of IT provider.
Insurers ask different questions, but a current plan, a recent exercise and evidence of phishing awareness answer the ones we see most often. We will not invent a certificate an insurer has not asked for.