Plan incident support before an executive account or device is compromised. Define activation, authority, evidence handling, containment and recovery.
Define activation and availability
An incident-response retainer is an arrangement for access to agreed assistance. It should state contact routes, availability, response objectives, included hours and exclusions. It is not automatically a monitoring service or a guarantee of immediate recovery.
Agree who can activate the engagement, approve additional work and provide access. Establish an alternative identity-verification method if the caller’s normal mailbox or telephone is affected. Include deputies and an emergency contact list maintained outside the suspected account.
Prepare a minimum evidence package
Record the affected accounts or devices, the first known indication, relevant timestamps and actions already taken. Preserve original messages with headers, relevant audit records and suspicious transaction instructions where authorised. Do not forward sensitive evidence to unrelated parties.
The examiner should document collection source, method, timestamps and integrity checks, together with access limitations. Forensic acquisition, cloud-log collection and legal preservation needs differ. Agree scope and handling with authorised advisers before broad collection.
Coordinate containment with continuity
Containment may include revoking sessions, restricting an application, disabling forwarding or isolating a device. Choose actions according to the evidence and business impact, and record their timing. An urgent action can change evidence, so coordinate responders where feasible.
For suspected payment fraud, contact the financial institution through a verified channel promptly. Technical responders cannot promise fund recovery. For extortion or sensitive disclosure, coordinate technical evidence, legal advice and communications under named decision-makers.
Specify recovery and the closing report
Define what constitutes a trusted recovery state: credentials and sessions reviewed, relevant vulnerabilities addressed, backups tested and follow-up monitoring agreed. Re-enabling access is not the same as proving that every attacker foothold has been removed.
Require a timeline, affected scope, findings with confidence levels, actions taken, remaining uncertainty and remediation owners. Separate confirmed facts from hypotheses. TRUST-IT can scope incident response and digital forensics for an individual, enterprise or family office; availability and commitments must be agreed directly.