HSM IT ServicesIncident Response
Calm, experienced help to contain a cyber incident, recover operations and meet your obligations. Our Incident Response helps organizations contain and recover from ransomware, business email compromise and other cyber incidents. We investigate what happened, remove the attacker, restore systems and help you coordinate with insurers, legal counsel and privacy regulators, then strengthen defences so it does not happen again.
A cyber incident is stressful, confusing and time-sensitive. Systems may be encrypted, email accounts may be sending fraud to your clients, and leadership must make decisions with incomplete information. Our Incident Response provides experienced people who bring structure to that moment. We work to contain the threat, preserve evidence, understand how the attacker got in and what they accessed, and restore operations in a controlled order that avoids reinfection.
Response follows recognized practice, aligned with the Respond and Recover functions of NIST CSF 2.0. We coordinate with your cyber insurer and breach coach where you have one, preserve logs and forensic data, and document our findings carefully because they may inform decisions about notification. Under PIPA, a breach involving a real risk of significant harm must be reported to the Information and Privacy Commissioner, and health custodians have duties under the HIA. We provide the technical facts your counsel needs.
The best time to plan for an incident is before one happens. HSM IT Services offers incident response planning and tabletop exercises that walk leadership and staff through realistic scenarios such as ransomware or wire fraud. You leave with a written plan, a contact list and clear decision authority. Clients on a retainer agree response procedures with us in advance, which reduces delay and confusion when a real incident occurs.
What is included
- Emergency incident containment and eradication
- Ransomware and business email compromise investigation
- Log and forensic evidence preservation
- Coordination with insurers, breach coaches and legal counsel
- System recovery and secure restoration
- Technical findings to support breach notification decisions
- Incident response plan development
- Tabletop exercises for leadership and staff
How it works
Contain
We stop the spread by isolating affected systems and accounts while preserving evidence.
Investigate
We determine how the attacker got in, what they did and what information may have been accessed.
Recover
We remove the threat, restore systems from clean sources and monitor closely for any return.
Strengthen
We deliver a report with root cause and recommendations, and help implement the fixes.
Who it is for
Incident Response is for any organization dealing with a suspected or confirmed cyber incident, whether or not it is an existing HSM IT Services client. Planning, retainers and tabletop exercises suit organizations that want to be prepared, including those whose insurer, board or clients expect a tested incident response plan, and health custodians who must be ready to meet HIA breach obligations.
Questions we hear
What should we do first if we suspect an incident?
Avoid turning systems off or wiping devices, as this can destroy evidence. Disconnect affected machines from the network if you can do so safely, do not pay any ransom demand, and contact your incident response provider and cyber insurer. If you have an incident response plan, follow it. HSM IT Services will guide you through the next steps.
Do we have to report a cyber incident?
It depends on what happened and the information involved. Under PIPA, organizations must notify the Information and Privacy Commissioner without unreasonable delay when a breach creates a real risk of significant harm, and the Commissioner may require notice to affected individuals. Health custodians have separate obligations under the HIA. Legal counsel should advise on notification, and HSM IT Services provides the technical findings needed to make that decision.
Can HSM IT Services help with an incident even if we are not a client?
Yes. We assist organizations that are not existing clients, although response is usually faster when we already know the environment or have a retainer in place. We start by understanding the situation, agreeing on scope and authorization, and then work alongside your staff, IT provider and insurer to contain and recover.