Incident Response Planning and Security Awareness Training

Who this is for

This service is for small and mid-size businesses that would struggle to answer a simple question: if an employee clicked the wrong link this morning and files started locking up, who decides what happens next?

It fits especially well for:

• Medical, dental and other healthcare offices that hold patient records and need the schedule to keep running. See ransomware readiness for medical and dental offices.
• Accounting, law, real estate and title offices that move money or handle wire instructions, where business email compromise is a common and expensive problem.
• Small defense suppliers under DFARS 252.204-7012, which requires reporting cyber incidents to DoD within 72 hours of discovery.
• Any business whose cyber insurance application asks about a written incident response plan or staff training. See the cyber insurance questionnaire guide.

What you get

Every engagement is scoped in writing first, so you choose the pieces you need. A full engagement typically includes:

• A written incident response plan sized for a small business: roles, who has authority to decide, how to reach each other if email is down, and first-hour steps.
• One-page scenario playbooks for ransomware, business email compromise and wire fraud, a compromised Microsoft 365 or Google Workspace account, a lost or stolen laptop or phone, and a breach at a vendor that holds your data.
• An emergency contact sheet with your insurer's claims line, your bank's fraud line, your IT provider, your attorney and key vendors, stored somewhere that does not depend on your network.
• An evidence preservation checklist so staff disconnect an affected computer from the network instead of wiping it, and keep the logs and emails investigators will ask for.
• Internal communication checklists with placeholders for messages your attorney drafts or approves; Keith Systems does not write breach notices.
• A backup recovery check: questions that confirm someone has actually restored files from backup and knows how long it takes.
• A tabletop exercise and after-action report with findings ranked by risk.
• A live awareness training session and a simple way for staff to report suspicious messages.

You own all of it. Nothing depends on a subscription.

How the tabletop exercise works

A tabletop exercise is a structured discussion, not a technical test. No systems are touched. Your decision makers meet in a room or by video and work through a realistic scenario built around your business.

1. We agree on the scenario in advance, for example a fake invoice change request from a real vendor, or files encrypting on the front desk computer on a Monday morning.
2. During the session, usually 60 to 90 minutes, new details arrive in stages: a ransom note appears, a customer calls, the newest backup turns out to be a week old.
3. The group decides what to do at each step. The goal is to find gaps while the stakes are zero: missing phone numbers, unclear authority, passwords only one person knows.
4. You receive a short after-action report covering what worked, what broke, and specific fixes in priority order.

CISA publishes free tabletop exercise packages at cisa.gov. A facilitated session adds a scenario that matches how your office really operates.

Staff security awareness training

Training is a live session, on site or by video, typically 45 to 60 minutes, focused on the habits that prevent the most common losses:

• Verifying any change to payment or bank details by calling a known phone number, never the one in the email.
• Recognizing phishing messages, fake login pages and unexpected multi-factor authentication prompts, and never approving a prompt you did not start.
• Using a password manager and unique passwords.
• Reporting mistakes quickly and without blame, because a report in the first ten minutes is worth far more than one the next day.

Examples are tailored by role. Front desk staff, bookkeepers and owners face different tricks.

How an engagement runs

1. Free consult of about 30 minutes to understand your business and what you already have. Book a free security consult.
2. Written scope with the fee stated before any work begins.
3. Interviews, usually remote, with the owner, office manager and whoever handles IT.
4. Draft plan and playbooks for your review.
5. Tabletop and training, on site in Santa Barbara County and southern San Luis Obispo County, or remote anywhere.
6. Final documents and the after-action report.

If you want to start on your own, the incident response plan guide explains what belongs in a small business plan.

Good to know

This is preparation work: a plan, a tabletop and training. It works alongside, not instead of, the forensics firm or breach coach your insurer may require. Notification duties depend on facts your attorney should weigh, since Keith Systems isn't a law firm. The FTC and HHS have useful guidance.