When Your Network Is Burning, Call the Forensic Examiner First

Petronella Technology Group structures every engagement against NIST Special Publication 800-61 Revision 2. That is the same framework Federal civilian agencies, DFARS-bound defense contractors, and the CISA Joint Cyber Defense Collaborative use to evaluate response maturity. It is the one your cyber insurance breach coach, your CMMC assessor, and your regulator already speak - aligning to it removes a translation step at the worst possible moment. Each phase below describes what we actually do in the field, what artifacts we produce, and where your team has to be in the loop.

Ad-hoc engagement is real and we take it. It is just more expensive per hour, slower to start, and more punishing on your team. If you have not signed a retainer with anyone yet, this is the meeting to schedule.

The most common breach-aftermath surprise is a phone call from outside counsel six months in: "Can we get the forensic image of the affected machine? We have a regulator request." If the answer is "we wiped it and reimaged," there is no answer to give. The evidence does not exist.

Petronella's incident response engagements include forensic-grade evidence collection by default, not as an upsell. That means: write-blocked disk imaging with MD5 and SHA-256 hash baselining, volatile memory capture, log preservation in original format with cryptographic integrity, and a chain-of-custody log signed by both the investigator and the client at every transfer. The evidence sits in our secure Raleigh lab until you say to release it, destroy it, or hand it off to outside counsel.

For matters that require deeper investigation than the IR engagement covers - civil litigation, regulator-driven forensic analysis, expert witness testimony - we transition the engagement to our companion digital forensics practice under the same DFE credential. The evidence chain does not break, because the people holding the evidence do not change. What we do not do, and tell you upfront: consumer mobile-device forensics, iPhone jailbreaking, custody / family-law device imaging, or private-investigator work. Honest scope is admissible scope.

When you call us during an active breach, one of our first questions is "do you have cyber insurance?" That answer changes the next 15 minutes. If yes, you contact the carrier's claims line in parallel with engaging us, because most carriers require notice within a specific window and require pre-approval of vendors. We are panel-approved with multiple major US cyber carriers and can be engaged inside that framework.

Your carrier will likely assign a breach coach attorney whose job is privilege management, regulatory analysis, and notice coordination. We work under the breach coach's direction during active incidents, so our investigative work product is covered by attorney work-product doctrine. We do not freelance regulatory advice or draft notification letters - those are the breach coach's lane, and trying to be helpful in someone else's lane is how privilege gets pierced.

We coordinate, in lane, with: the carrier's claims adjuster (status, cost authorization, settlement-relevant findings), the breach coach attorney (privileged investigative findings, notification scope), your in-house or outside counsel (litigation hold, employee matters, vendor claims), the FBI and CISA where the incident type warrants, and your comms / PR resources where public notice is required. What we are not: we are not your law firm, your breach coach, your ransom negotiator, or your insurer's adjuster. Each is a separate licensed function. We are tightly scoped to investigation, containment, evidence preservation, and remediation - and we say so on the first call.

A written incident response plan is a regulatory expectation under nearly every framework you might be subject to. CMMC IR.L2-3.6.1 requires an incident handling capability covering preparation, detection, analysis, containment, recovery, and user response. HIPAA Contingency Plan (45 CFR 164.308(a)(7)) requires response and reporting procedures. SOC 2 CC7.3 evaluates whether the entity responds to incidents through documented procedures. NIST Cybersecurity Framework 2.0 "Respond" function maps to all of the above.

The plan satisfies the framework. The runbooks satisfy reality. Generic IR plans die in the binder where they were written. Per-incident-type runbooks (ransomware, BEC, account takeover, data exfil, insider threat) are the operational documents your team actually opens at 2am. We write those with your environment's specifics: which EDR console to check first, which Conditional Access lock to flip, which carrier claims number is on file.

The tabletop is where the plan and runbooks get stress-tested in a low-cost environment. We facilitate a 90-minute exercise with your executive sponsor, IT lead, legal contact, and comms lead. A realistic industry scenario plays out turn by turn; we capture decisions, gaps, and friction. The output is a remediation list for the plan, the runbook, the call tree, or the underlying controls. Done annually, the muscle memory builds.

For retainer clients we run one tabletop per year as part of the retainer fee, which also satisfies CMMC IR.L2-3.6.3 ("Test the organizational incident response capability") for organizations pursuing certification at L1, L2, or L3, and matches the cadence most cyber insurance carriers expect. Additional sector-specific tabletops are available - for example a ransomware exercise scoped to a manufacturer's production control environment, or a BEC exercise scoped to an engineering firm's wire-transfer workflow.

An incident response drill is a planned rehearsal in which your organization works a simulated security incident against its own written plan, runbooks, and call tree, while facilitators inject new information and observers record what your people actually do. It is deliberately not a technology test. The systems under examination are decision authority, escalation thresholds, communication paths, and timing. A drill answers one question: if this happened for real on a Tuesday afternoon, would the plan on the shelf survive contact with your own staff?

Federal guidance treats exercises as a formal program rather than a one-off event. NIST Special Publication 800-84, "Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities," separates discussion-based events (seminars, workshops, tabletop exercises) from operations-based events (drills, functional exercises, full-scale exercises), and recommends building the program in that order so that people understand the plan before they are asked to execute it under pressure. NIST SP 800-61 Rev 2 places exercises squarely inside the Preparation phase, which is the phase that determines whether the other three phases work at all. Sources: NIST SP 800-84 and NIST SP 800-61 Rev 2.

Who participates. A drill fails quietly when the room is all engineers. The minimum useful roster is an executive sponsor who genuinely holds the authority to take systems offline and to authorize spend, the IT or security lead who will run containment, a legal contact, and a communications lead. Depending on scenario, add finance for wire-fraud and business email compromise scenarios, HR for insider-threat scenarios, and your managed service provider or cloud administrator when the environment is outsourced. External parties, including the insurer-appointed breach coach, can be simulated by a facilitator in early exercises and invited for real once the internal muscle memory exists.

What a drill actually tests. In our experience the same failure modes recur across industries, and none of them are technical. Whether the escalation threshold is written down or improvised. Whether the call tree is reachable out-of-band when corporate email and Teams are the untrusted systems. Whether anyone knows the regulatory clocks described in the notification section above are already running. Whether the instinct under pressure is to reimage the compromised laptop, destroying the evidence a forensic examiner and an insurance carrier both need. Whether the runbook step referenced in the plan exists, is current, and names a tool the organization still owns. Whether the person authorized to declare an incident is reachable at 2am. A drill converts each of those from an assumption into a documented finding.

Cadence. Annual is the practical floor and the one most cyber insurance carriers expect at renewal. Defense contractors have a specific obligation: testing the organizational incident response capability is its own requirement under CMMC IR.L2-3.6.3 and NIST SP 800-171 3.6.3, and an untested plan does not satisfy it. Beyond the calendar, run an exercise after any event that invalidates the plan: a merger or acquisition, a new ERP or EHR platform, a cloud migration, a change of managed service provider, or turnover in any named role in the call tree. Organizations that treat drills as a program rather than an annual chore typically layer a short narrow drill each quarter on top of the annual tabletop.

How findings feed back into the plan. The deliverable is not the exercise, it is the after-action report. Ours records the scenario and injects, a decision timeline with timestamps, the gaps observed, and a prioritized remediation list where every item has a named owner and a due date. Findings sort into four buckets: fix the plan, fix the runbook, fix the underlying control, or fix the training. Items that change a decision path get re-tested at the next exercise rather than being marked closed on paper. That loop is exactly the Post-Incident Activity discipline described earlier on this page, applied to a simulated incident so the lesson costs a morning instead of a breach. If you want that loop run for your environment, book a 30-minute planning call; ongoing skills work is covered separately through our incident response training programs.

Before the structure, one distinction that most templates blur. NIST SP 800-61 Rev 2 describes three separate artifacts: a policy (management's statement of authority, scope, and definitions), a plan (the roadmap for implementing the capability, with mission, goals, metrics, and organizational approach), and procedures or runbooks (the step-by-step technical instructions). A template that mixes all three into one document tends to be too abstract to execute and too specific to get executive sign-off. Keep them layered: short policy, readable plan, deep runbooks. The publication also states plainly that the plan should be reviewed and approved by senior management, which is the single element most self-built templates omit.

Two appendices turn a plan into something usable rather than something filed: a contact appendix (roles to people, with out-of-band numbers, carrier claims line, breach coach, and law enforcement points of contact) and a per-incident-type runbook set. Keeping people and tooling detail in appendices means the body of the plan, which requires executive approval to change, stays stable while the volatile parts get updated as often as reality demands.

Petronella Technology Group publishes a structured incident response plan template covering the phases above; you can request the incident response plan template from our resources library. For broader background on how the phases fit together before you start filling sections in, our guide to incident response walks the same lifecycle in plain language. If you would rather have the plan, the runbooks, and the first tabletop built against your actual environment instead of a blank template, that work is the pre-breach half of the retainer described above, and it starts with a 30-minute call.

If your matter sits in the right-hand column, we tell you on the first call and route you to the right specialist. Honest scope is admissible scope.