Incident response & ransomware readiness for Ottawa & Gatineau
When a breach or ransomware hits, the first hours decide everything. We get you ready in advance: a clear plan, a trained team and the certainty of knowing exactly what to do — so you contain it fast and get back to business sooner.
Incident response readiness is everything you put in place before an attack so it doesn't become a catastrophe: a written plan, defined roles, playbooks, rehearsals and the right contacts at hand. When every minute counts, you act instead of improvising.
Our role is preparation and coordination — building the plan, training your team, and orchestrating the response when it counts. For real-time, 24/7 detection and containment, this service pairs with our managed detection & response. We're not a round-the-clock in-house digital-forensics lab; we're the local partner who gets you ready and runs point, bringing in the right specialist resources when needed.
Ready before, calm during
Response plan & playbooks
A written response plan and step-by-step playbooks for your most likely scenarios — ransomware, email compromise, data leak. Everyone knows their role, and no one improvises under pressure.
Tabletop exercises
Guided walkthroughs that rehearse your team before it's real. We run a credible scenario, surface blind spots and settle the hard questions — who decides, who communicates — in calm rather than in crisis.
Ransomware readiness
A focused review of your ransomware resilience: isolated and tested backups, segmentation, identity hardening, and a clear course of action if the worst happens — so you can restore rather than pay.
Law 25 assessment & register
We build Law 25 obligations into your plan: a harm-assessment template, a confidentiality-incident register and a notification path — so compliance is part of the response, not a last-minute scramble.
Breach-notification support
If an incident is reportable, we help you notify the Commission d'accès à l'information, affected individuals and other required parties — clearly, on time and defensibly.
"Who to call first"
A local, bilingual partner who already knows your environment and whom you reach in the first hour — not an unknown number on a bad morning. We coordinate the response and mobilize the right resources.
Incident readiness is part of a mature security program. If you need ongoing security leadership to build and maintain that program — including the role of point person during an incident or audit — our virtual CISO (vCISO) and Law 25 compliance services fit directly with this one.
Frequently asked questions
Do you provide 24/7 emergency response during an active attack?
Our strength is preparation and coordination: we help you build the plan, train the team, and know exactly who to call and what to do in the first hour. For continuous, real-time detection and response, this service pairs with our managed detection and response (MDR), which watches your environment 24/7. If an incident hits, we coordinate the response and bring in the right specialist resources.
Why prepare if we've never been hit?
Because the worst time to design a plan is in the middle of a crisis. Organizations that have rehearsed in advance contain incidents faster, lose less data and get back to business sooner — while others improvise. Readiness costs a fraction of a single mishandled incident, and cyber-insurers increasingly require it.
What is a tabletop exercise?
It's a guided walkthrough: we gather your decision-makers and run a realistic scenario — ransomware, a data leak — step by step. Everyone practises their role in a no-stakes setting, which surfaces blind spots (Who talks to customers? Who decides whether to pay? Where are the backups?) before they become real problems.
How does Law 25 affect incident response?
Quebec's Law 25 requires organizations to assess any confidentiality incident, keep a register, and notify the Commission d'accès à l'information and affected individuals when there's a risk of serious injury. We build these obligations into your plan — an assessment template, a register and a notification path — so compliance is part of the response, not an afterthought.
How quickly must a confidentiality incident be reported to the Commission d'accès à l'information?
Law 25 doesn't set a fixed number of hours: it requires you to notify the Commission d'accès à l'information and the affected individuals "with diligence" once an incident presents a risk of serious injury. In practice that means promptly — as soon as your seriousness assessment is done, not the following week. Every confidentiality incident, reportable or not, also has to be assessed and recorded in your incident register. Having the assessment template, the register and the notification path ready in advance is what makes "with diligence" achievable.
Get ready before you need it
Let's build your incident response plan and rehearse it — so your team knows exactly what to do when it counts.
Get in touch