Incident Response Service IR

A pre-arranged agreement (retainer) with an expert team that steps in within hours of a serious incident (ransomware, data breach). It covers forensic analysis, removing the attacker, recovery and support with legal notifications.

When you need it

• If ransomware hit, it isn't clear who you would call in the first hour
• Your own team can't do forensic analysis
• You want to be ready for the 72-hour breach notification deadline under KVKK (Turkish data protection law)

When you do not need it

• If your MDR contract covers full incident response, you may not need it separately; read the contract.
• If your cyber insurance provides an incident response team, start with that.

Sign it before an incident happens. Prefer agreements that let you convert unused hours into an annual exercise (tabletop scenario) or a penetration test.