Incident ResponseBook a consultationLV

Contract-client incident activation

Contract-defined availability for active contract clients under retainer. If experiencing a security incident, follow emergency protocol.

Contract-client incident line+371 27878799Get the first-actions checklist

When to activate assistance

Situations that should not wait

Ransomware, malware or mass encryptionMicrosoft 365, email, cloud or administrator account takeoverData exposure or unauthorised public accessWeb, API or infrastructure compromiseDenial of service, DDoS or material operational disruptionFraudulent payment or business-email-compromise indicators

What we coordinate

From triage to safe recovery

  1. Secure incident activation and authority confirmation

  2. Initial triage and containment priorities

  3. Timeline and hypothesis of affected systems and accounts

  4. Evidence and action log

  5. Executive situation updates at an agreed cadence

  6. Recovery and safe-return criteria

Before we start

Frequently asked questions

Where should we start?

Start with the business objective, critical services and the main uncertainty. A short discovery call establishes whether the right path is governance, testing, monitoring or incident readiness.

Can we begin with a small scope?

Yes. The work can be divided into a priority first stage and a longer roadmap. The first stage still needs to produce a usable decision rather than a generic presentation.

How is our information protected?

Before accessing data, we agree confidentiality, authorised systems, data minimisation, storage, encryption, access control and deletion. The exact terms must be included in the contract and statement of work.

What should we do in the first 15 minutes?

Activate the incident lead, record times and observations, isolate clearly compromised endpoints only when this will not endanger a critical process, preserve logs and contact support through a verified channel. Do not shut systems down at scale without a plan.

Must we notify CERT.LV or a regulator immediately?

It depends on the incident, entity status and applicable requirements. The response team can help prepare technical facts, while legal duties and deadlines are confirmed by the organisation’s accountable functions and competent authorities.

Related next steps

Home

BR²SEC delivers independent cybersecurity assessments, technical audits, and regulatory compliance (NIS2, DORA, NKDL). We provide precise, evidence-backed findings alongside an actionable remediation roadmap for executive and engineering teams.

Contact

Book a 30-minute discovery call or submit a scoping request directly to our senior security engineers.

Incident Response

Prepare your organization for cyber incidents before they happen: response retainer readiness, playbooks, and tabletop simulation exercises.