Security Managed Service: Incident Response — Incident Investigation & Recovery Guidance

Security Managed Service: Incident Response is an IT Partner monthly subscription service for companies that have experienced or suspect an information security incident. IT Partner specialists analyze the company infrastructure and event logs, interview users if necessary, and provide a report with findings and recommendations to help prevent recurrence.

This service can be ordered for incidents such as unauthorized employee access to information, disclosure of confidential information to third parties, viral activity, suspected data encryption or blocked systems, suspected crypto miner activity, spamming from employee accounts, or malicious software on the company website. It is designed for a defined incident or suspected incident, because the deliverable is a report about what was found in that case.

The service includes analysis of the client infrastructure, including servers, workstations, and network hardware, to identify vulnerabilities or suspicious activity related to the incident. IT Partner also reviews relevant logs, may interview users if necessary, and prepares a report with incident information and safety recommendations. The included outcome is investigation and guidance, not full implementation of all recommended changes.

This service does not include purchasing licenses for products, setting up products or services that are not required for incident investigation, or implementing products and solutions proposed in the final report. Those activities are outside the stated scope because the service is focused on analyzing the incident and delivering findings and recommendations.

The plan may vary depending on the client’s needs and the information available, so any scheduling details should be confirmed with IT Partner during kickoff.

It is described as a monthly subscription service, so buyers should confirm billing details and any renewal terms with IT Partner before ordering.

The deliverable is a report based on the results of IT Partner’s work. The report contains information obtained about the incident and recommendations to improve safety and reduce the chance of the same type of incident recurring.

The service is considered successful when the client receives a report containing information obtained about the incident and recommendations on how to prevent it from recurring. The success criteria focus on investigation findings and recommendations, not on guaranteed eradication, remediation, or legal conclusions.

The engagement starts with a kickoff meeting, followed by the client providing necessary information about the incident or incidents. IT Partner specialists then analyze the data, infrastructure, and logs, and finally prepare and provide the report to the client.

Yes. IT Partner’s responsibilities include analyzing client infrastructure such as servers, workstations, and network hardware to detect vulnerabilities, as well as reviewing logs from those systems to identify traces of suspicious activity.

Yes. Log analysis for servers, workstations, and network hardware is part of IT Partner’s stated responsibility, because suspicious activity often leaves traces in system and infrastructure logs. The value of the review depends on the logs and incident information the client can provide.

IT Partner may interview users if necessary as part of understanding the incident. Interviews are not described as mandatory for every case, because the service scope says they are performed when needed.

There are no formal prerequisites listed for this service. However, the client is responsible for providing necessary information about existing hardware, servers, and workstations, assigning a dedicated point of contact, and coordinating any outside vendor resources and schedules.

The client is responsible for coordinating outside vendor resources and schedules. This matters because IT Partner can analyze the client environment and logs, but access to third-party systems or vendor-managed infrastructure may require the client’s coordination.

The service description does not specify planned downtime, and the stated work is investigative analysis of infrastructure, logs, and incident information. Any possible business impact depends on the environment, access method, and incident conditions, so downtime or operational constraints should be confirmed with IT Partner during kickoff.

The stated scope is incident investigation, analysis, reporting, and recommendations. Malware removal, crypto miner eradication, data restoration, or implementation of proposed solutions is not explicitly included, so those activities should be treated as separate unless IT Partner confirms they are required for investigation and within scope.

Yes. Spamming on behalf of employees is one of the incident examples listed for this service. IT Partner can investigate relevant infrastructure and logs and provide findings and recommendations to help prevent recurrence.

Yes. Malicious software on the company website is one of the listed situations where the service can be ordered. The engagement focuses on analyzing the incident and providing a report with recommendations, not necessarily implementing website cleanup or new security products.

After completion, the client receives the report with incident information and recommendations to improve safety and prevent similar incidents. Implementing products, services, or solutions proposed in the report is not included in this service, so follow-up remediation should be planned separately if needed.