Incident Response & Business Continuity
Last Updated: October 6, 2026
1. Approach
Our incident-response (IR) approach follows NIST SP 800-61 and is written to be usable under pressure by a small team: clear roles, short playbooks, early decisions about evidence and reporting, and a blameless review afterward.
2. Lifecycle
- Preparation: defined roles and contacts, logging and alerting on key systems, tested backups, playbooks for likely scenarios (phishing and account compromise, malware, data exposure, vendor compromise).
- Detection and analysis: triage reports, scope the impact, classify severity, and start an incident record with timestamps.
- Containment, eradication, and recovery: isolate affected accounts or systems, remove the cause, restore from known-good sources, and verify before returning to service.
- Post-incident activity: a blameless review, root-cause analysis, and corrective actions tracked to closure in our risk register.
3. Evidence and Forensics
We preserve volatile and persistent evidence before remediation where feasible, record chain of custody, work from forensic copies rather than originals, and involve legal counsel and customers early when an incident may implicate law, contracts, or investigations.
4. Reporting Obligations
Reporting duties depend on the contract and the data involved. Contract terms always take precedence over this summary.
- DoD contracts with DFARS 252.204-7012: cyber incidents affecting covered defense information are reported to DoD within 72 hours of discovery, and malicious software and relevant media are preserved and submitted as required.
- Other federal contracts: we follow the incident clause, agency requirements, and the contracting officer's instructions, which can set shorter timelines.
- Personal information: we assess state breach-notification laws and customer agreements.
- Customers and teammates: we notify affected customers and teaming partners as agreements require.
5. Exercises
We exercise the plan through tabletop scenarios and review the playbooks after each exercise or real incident, updating roles, contacts, and decision points.
6. Business Continuity and Disaster Recovery
Continuity planning starts with a business impact analysis that identifies critical functions, how long each can be down (recovery time objective), and how much data loss is tolerable (recovery point objective).
- Distributed work: our operations do not depend on a single office; staff can work securely from alternate locations.
- Backups and recovery: critical business data and source repositories are backed up and recovery is tested.
- This website: content and code live in version control, so the site can be rebuilt and redeployed from source if the hosting platform is disrupted.
- Continuity of operations (COOP): for customer engagements, we align continuity and information-assurance requirements with the customer's COOP and contract terms.
- Testing and updating: plans are reviewed after exercises, incidents, and major changes.