When systems go down,the first hoursdecide everything.

Isolate affected systems without powering off or wiping them, preserve logs, and call us and your insurer. Avoid contacting the attacker or deleting anything before advice.

Use a separate channel for incident communication, as email may be compromised.

CERT-In directions require certain cyber incidents to be reported within six hours of noticing them, with logs kept for a prescribed period.

We assess whether your incident is reportable and prepare the notice.

Under the DPDP Act, a data fiduciary must intimate the Data Protection Board and affected individuals of a personal data breach in the manner prescribed. Other laws and contracts may add duties.

We map every notification duty that applies to you.

That is a business decision with legal limits. Payment may raise sanctions, reporting and insurance issues, and there is no guarantee of restored data.

We advise on the risks and the alternatives so leadership can decide with a record.

Engaging investigators through counsel helps protect privilege where the law allows, but it is not guaranteed and depends on the facts and how the report is used.

We structure the engagement with that in mind.

Often in part, subject to policy terms, notice deadlines and conditions. Late notice or unapproved vendors can affect cover.

We review your policy and manage the claim.

Incident response is scoped on the first call, and retainers give you pre-agreed terms and priority. Fees are always agreed in writing.

Ask us about a SIRI Shield retainer so you are prepared before an incident.