Initial scoping
Establish reported symptoms, affected systems and immediate business priorities.
Understand the situation
Plan the next step
If you suspect account compromise, ransomware or unauthorised access, send a brief description. We confirm availability, scope and engagement terms before accepting incident support work.
For businesses seeking a practical assessment of support and recovery options following a suspected security incident.
SCOPE
What we can take care of
Each item is confirmed in the engagement scope.
Containment planning
Recommend and, where authorised, carry out agreed steps to limit further impact.
Recovery coordination
Assess available recovery options and coordinate agreed restoration work.
Incident record
Document actions, known limitations and recommended follow-up improvements.
DELIVERABLES
Know what you receive
Frequency, responsibilities, service hours and any separately charged work are agreed before the engagement.
- Confirmed support scope
- Action and coordination records
- Known limitations and open questions
- Recommended follow-up improvements
RESPONSIBILITIES & LIMITS
Agree the details before work starts
Clear boundaries make proposals easier to compare and day-to-day follow-up easier to manage.
Confirm separately
- Specialist forensics, legal advice, insurer coordination and regulator reporting need separate arrangements.
- Recovery depends on available evidence, backups and the condition of affected systems.
- A submitted enquiry does not confirm incident acceptance or response timing.
What remains our responsibility?
Your company identifies the authorised decision-maker, business priorities and owners of systems and data. Approvals, safe access, current supplier coordination and agreed internal actions remain necessary.
What if the incident scope expands?
Update the known impact and business priorities, then confirm authority, available support, fees and third-party involvement for additional work. Decisions that belong to the business require its confirmation.
BEFORE YOU DECIDE
Your questions answered
Can you start immediately?
Availability must be confirmed. An enquiry does not confirm acceptance or immediate response. During an active incident, also contact your existing IT support or incident lead.
Can you guarantee recovery or identify the attacker?
Outcomes depend on the incident, available evidence and recovery options. Specialist digital forensics, legal advice or other help may require a separate engagement.
What should we send initially?
Contact details, a short description, when it started and affected systems. Do not submit passwords, recovery codes, confidential files or suspicious attachments.
Should we send logs or suspicious attachments at first contact?
Start with discovery time, symptoms, affected systems and a reliable contact method. Logs can contain personal or confidential information. Agree authority, scope and a secure transfer method before sharing detailed evidence.
BEFORE WE START
How we define your service
- Your environment
- People, devices, locations and existing systems
- Included work
- Agreed tasks, licences and separately priced items
- Service arrangements
- Coverage hours, review frequency and handover timing
Public guidance and further reading
These independent educational resources support general preparation. They do not imply a partnership, accreditation or endorsement of GDMME. Check the original guidance for its scope and publication date.
Tell us what you need
Share your company size and a brief description. We will confirm the possible next steps.