Incident response and recovery

Set incident decision rights before pressure removes the time.

Yojo structures readiness reviews and tabletop exercises around critical services, decision-makers, communications, and recovery dependencies. Active incident support is not included.

Plan an incident-readiness session

This work becomes relevant when the route is unclear.

  1. The response plan is untested

    A document exists, but decision-makers and operating teams have not worked through a realistic sequence together.

  2. Critical decisions have no named authority

    Containment, downtime, communications, regulatory, and recovery choices could be delayed because decision rights are assumed rather than recorded.

  3. Recovery assumptions have changed

    New platforms, suppliers, dependencies, or business priorities have made existing contacts and recovery plans unreliable.

Questions the engagement must resolve.

  1. Who can authorise containment, downtime, external communication, and recovery?

  2. Which services must recover first and what do they depend on?

  3. What information must be preserved for technical, legal, insurer, and leadership decisions?

  4. Which coordination gaps should be corrected before a live incident?

How the workstreams connect.

The engagement boundary determines how far each stream goes. The sequence is adjusted to the agreed question, access, and operating constraints.

  1. Readiness review

    Review current plans, contacts, decision authorities, critical services, communication paths, and recovery assumptions.

  2. Decision and escalation map

    Record who decides, who advises, who acts, and how unresolved issues move between business and technical teams.

  3. Tabletop exercise

    Facilitate an agreed scenario that tests coordination and decisions without claiming to validate every technical control.

  4. Recovery and follow-through

    Review service dependencies, restoration decisions, unresolved assumptions, and actions arising from the exercise.

System viewPreparation and response streams form a recovery loop. The workstreams are Readiness review, Decision and escalation map, Tabletop exercise, Recovery and follow-through.

Expected outputs, qualified before delivery.

These are proposed artefacts. Their format, audience, evidence threshold, and ownership are agreed within the engagement boundary.

Exercise brief
A scenario, objectives, participants, boundaries, and handling rules to agree before the session.
Decision map
A proposed record of authorities, advisers, escalation contacts, and decisions that remain with the organisation.
Recovery dependency record
Critical services, supporting systems, suppliers, owners, and restoration assumptions to confirm with operational teams.
Observation and action log
A proposed record of coordination gaps, decisions, owners, and due dates for client approval after the session.

A useful boundary is explicit on both sides.

What the client provides

  • Ensure the relevant executive, technical, legal, communication, and operational decision-makers participate.
  • Provide current plans, contacts, service dependencies, supplier information, and known response constraints.
  • Confirm how sensitive exercise information will be handled and who may receive the final record.
  • Own legal, regulatory, insurer, communication, business-continuity, and recovery decisions.

What the service does not claim

  • Urgent or active incident support is not included.
  • A tabletop exercise tests coordination and assumptions; it does not validate every safeguard or guarantee recovery performance.
  • Digital forensics, malware analysis, negotiation, legal advice, external communication, and hands-on recovery are excluded unless separately agreed.

A concise operating sequence.

Each point is a decision gate. Work moves forward when the required people, evidence, and authority are in place.

  1. Prepare

    Agree objectives, scenario, participants, sensitive handling, and exercise boundaries.

  2. Exercise

    Present the scenario in stages and record decisions, assumptions, and coordination gaps.

  3. Close

    Review observations, owners, due dates, and changes to plans or recovery assumptions.

Related intelligence

Incident response and recovery readiness

Read the briefing

Bring the systems, constraint, known concern, and decision that the work must support.

Plan an incident-readiness session