Services
Which situation is yours?
01 Retainer
Your regulator expects incident response capability.
The situation
An examiner has asked for your incident response plan, or will. Your board wants a name for who takes the 2 a.m. call.
What we do
We write the plan around your environment, then drill it twice a year with the people who would run it. A senior responder stays on call and reaches you within four hours. The contract guarantees it. We agree terms up front, so the first hour goes to the response, not paperwork.
What you receive
A plan your team can run without us. Exercise reports your auditors will accept, mapped to the framework your examiner uses. And a phone number that is always answered.
The names on your audit letters
- Banking and finance
- Central Bank of Oman
- Insurance and capital markets
- Financial Services Authority (Oman)
- Power and utilities
- Authority for Public Services Regulation
- Critical infrastructure and government
- Cyber Defence Centre, Oman National CERT
- Any organisation holding personal data
- Oman Personal Data Protection Law
If one of these regulates you, the retainer is built around their expectations. Under a different authority? Ask.
02 Response
You are under attack.
The situation
Files are encrypting. A mailbox is sending things nobody wrote. Or something is off and nobody can say what yet.
What we do
A call now. Clear direction inside the hour. We stop the spread first, without destroying the evidence. Then we work out how they got in, what they touched, and whether they are still there. Remote first, on-site when it matters.
What you receive
Your operations back. A timeline that holds up. One report your executives, your regulator, and your engineers can each use.
03 Method
How a response runs.
Six phases. The order matters more than the speed.
- 01 Detect You call. We establish what you are seeing and how far it has reached.
- 02 Triage Scope before action. What is affected, what is clean, what is still at risk.
- 03 Contain Stop the spread without destroying the evidence. Isolate, do not wipe.
- 04 Eradicate Remove the access. Every route in, not the first one found.
- 05 Recover Back to work, in an order that does not put you back where you started.
- 06 Report One document your executives, your regulator, and your engineers can each use.
04 Forensics
You need evidence that survives scrutiny.
The situation
An employee left and the customer list may have left with them. Money moved and the explanation does not hold up.
What we do
Acquire the devices and logs, reconstruct what happened and by whose hand. Chain of custody from the first image onward.
What you receive
Findings a lawyer can use and we can defend under challenge. Preserved evidence. Expert testimony if it goes further.
05 Evidence
Everything is acquired before anything is opened.
Chain of custody starts at the first image, not at the report. That is what makes a finding survive a challenge.
- Devices
- Memory
- Firewall
- VPN
- Domain
Investigation
06 Contact
Not sure which one fits.
Ask. If you do not need us yet, we will say so.