Incident Response: Contain the Damage Fast When Something Goes Wrong
Pre-paid incident response retainers with documented runbooks and an agreed escalation process. Coverage hours, response targets or SLAs, fees, and any use or rollover of unused hours must be agreed in writing.
A cyber incident may involve ransomware, business email compromise, or an account takeover. Preparation helps your team identify who to contact, who can authorise action, and which systems matter most. The response depends on the incident, available evidence, access, and agreed responsibilities.
North Star, based in Prince George, BC, provides pre-paid incident response retainers for businesses across British Columbia, Alberta, and Yukon. We scope runbooks, escalation, evidence collection, and reporting with you. The written agreement defines coverage, response commitments, included work, and charges; a retainer does not guarantee recovery or an insurance outcome.
What Is Included
Pre-Paid Retainer
Discuss an annual block of 20, 40, or 80 hours based on your organisation's size and risk profile. Confirm the included hours, rates, overage approval and charges, expiry, and any rollover or security-improvement use in the written agreement. Do not assume a discount or automatic rollover.
Agreed Response Terms
Coverage hours, contact channels, severity definitions, response targets or SLAs, and escalation responsibilities must be agreed in writing. Acknowledgement, investigation, containment, and recovery are different stages. Work requires the agreed authorisation and access; a retainer does not imply immediate response or a fixed recovery time.
Documented Runbooks
Runbooks can address ransomware, business email compromise, insider threats, and supply chain incidents in your environment. Agree decision authority, communication paths, review frequency, and update triggers as part of the scope.
Forensic Evidence Collection
Scope evidence collection, imaging, timeline reconstruction, and investigation of indicators of compromise for authorised systems. Agree preservation and chain-of-custody requirements with your legal counsel and insurer where applicable. The available evidence and agreed collection method limit what can be established.
Post-Incident Reporting
Document findings, uncertainties, incident timelines, actions taken, and recommended remediation within the agreed scope. Technical records can support your internal review and discussions with counsel or insurers; reporting does not guarantee legal sufficiency, coverage, or claim payment.
How It Works
The Canadian Centre for Cyber Security recommends a written plan covering response roles, contact details, instructions for common incidents, and required reporting actions. Use its incident response planning guidance to review your internal responsibilities before agreeing an external provider's scope.
Step 1, Onboard
Document your environment, key contacts, escalation paths, access requirements, and decision authority. Draft runbooks for the agreed scope and confirm how to request help during contracted coverage hours.
Step 2, Tabletop Exercise
Schedule a tabletop exercise at an agreed frequency. Your leadership team walks through a realistic scenario to review runbooks, communications, and decision-making, then records gaps and follow-up actions.
Step 3, Respond
Triage the incident, agree priorities, and carry out authorised investigation, containment, remediation, and recovery work. Record actions and provide updates through agreed channels. Containment authority must be approved in advance or obtained during the incident; there is no blanket exception to authorisation.
Step 4, Post-Mortem
Agree reporting deliverables and timing. Summarise available evidence, likely causes where supported, unresolved questions, and remediation priorities. Coordinate technical documentation with your designated legal or insurance contacts.
Who This Is For
- BC, Alberta, or Yukon businesses that have cyber insurance but no incident response plan, and know the gap between having coverage and being prepared to use it
- Organisations required by their insurer to have documented incident response capability
- Businesses in sectors where a breach notification obligation exists, healthcare, financial services, legal, government contractors
- IT managers who need a credible escalation path for security incidents they cannot handle alone
What buyers ask before they sign
Why pre-pay rather than just call when something happens?
A retainer lets you agree contacts, access, authorisation, runbooks, and commercial terms before an incident. Coverage hours, response targets or SLAs, included hours, and additional charges must be documented in the agreement. It does not imply immediate response or a guaranteed recovery time. Compare the quoted retainer and emergency terms for your scope.
What if we do not use all the hours?
Expiry, rollover, and any use of unused hours for proactive security work depend on the written agreement. Confirm those terms before purchasing a retainer. Penetration testing, policy documentation, tabletop exercises, or training require an agreed scope; unused hours are not automatically transferable or non-expiring.
What incidents are covered?
The written scope defines covered systems, incident types, exclusions, and third-party responsibilities. Runbooks can address ransomware, business email compromise, credential breaches and account takeover, insider threats, and supply chain compromise. Confirm coverage for your environment rather than assuming every incident is included.
Can you help us notify regulators or insurers?
North Star can assist with technical incident timelines, findings, and documentation within the agreed scope. Your legal counsel determines notification obligations, and your insurer or broker confirms policy and reporting requirements. Technical assistance does not guarantee compliance, coverage, or claim payment.
What if we are in the middle of an incident right now?
Call 672-983-1174 to request help and confirm availability. If you have a retainer, use its agreed incident contact and escalation process. For new engagements, scope, rates, access, and authorisation must be agreed before work starts. Do not assume an immediate response or that emergency work is included in another service plan.
Why North Star
North Star is a Prince George-based cybersecurity provider serving businesses across Northern BC, BC, Alberta, and Yukon. We scope incident response planning and support for SMBs, with runbooks tailored to the agreed environment and responsibilities. Confirm evidence requirements with your legal counsel and insurer, and agree the work and fees before engagement.
More cybersecurity services
Get a quote on incident response.
Tell us about your environment so we can discuss scope, availability, and proposal timing. No obligation, no pressure.
Request a Quote Back to CybersecurityFrequently asked questions
What are incident response services?
Incident response services help organisations investigate and manage a suspected or confirmed security incident. North Star scopes triage, evidence collection, authorised containment, remediation, recovery planning, and reporting. Findings and recovery options depend on available evidence, system access, the incident, and the agreed work; a fully restored or incident-free environment is not guaranteed.
How fast can North Star respond to a security breach?
Response coverage hours, contact channels, severity definitions, response targets or SLAs, and escalation must be agreed in writing. For an active incident, call 672-983-1174 or use your contracted escalation process to confirm availability. Acknowledgement is not containment or recovery, and a retainer does not imply immediate response or a guaranteed recovery time.
Does my SMB need a formal incident response plan?
An incident response plan documents contacts, decision authority, escalation, and response priorities. North Star can help develop and exercise a plan for your environment within an agreed scope. Exercises identify follow-up work; a plan does not guarantee readiness for every incident or prevent data loss.
Can you help with ransomware recovery in Alberta?
North Star can scope ransomware response and recovery support for businesses in Calgary, Edmonton, Red Deer, and throughout Alberta. Work may include investigating affected systems, assessing available backups, planning authorised restoration, and recommending security improvements. Recovery feasibility and timing depend on the incident and backup condition; we cannot guarantee a completely clean environment or prevent another attack.