Security Managed Service: Incident Response — Incident Investigation & Recovery Guidance

Security Managed Service: Incident Response is a fixed-price IT Partner investigation service for companies that have experienced or suspect an information security incident. IT Partner specialists analyze the company infrastructure and event logs, interview users if necessary, and provide a report with findings and recommendations to help prevent recurrence.

This service can be ordered for incidents such as unauthorized employee access to information, disclosure of confidential information to third parties, viral activity, suspected data encryption or blocked systems, suspected crypto miner activity, spamming from employee accounts, or malicious software on the company website. It is designed for a defined incident or suspected incident, because the deliverable is a report about what was found in that case.

The service includes analysis of the client infrastructure, including servers, workstations, and network hardware, to identify vulnerabilities or suspicious activity related to the incident. IT Partner also reviews relevant logs, may interview users if necessary, and prepares a report with incident information and safety recommendations. The included outcome is investigation and guidance, not full implementation of all recommended changes.

This service does not include purchasing licenses for products, setting up products or services that are not required for incident investigation, or implementing products and solutions proposed in the final report. Those activities are outside the stated scope because the service is focused on analyzing the incident and delivering findings and recommendations.

The listed duration is 1 week. The plan may vary depending on the client's needs and the information available, so scheduling is confirmed with IT Partner during kickoff.

The service is $700 per project, quoted fixed-price in writing before work begins. The price covers the investigation and report; implementing the report's recommendations is quoted separately.

The engagement starts with a kickoff meeting, followed by the client providing necessary information about the incident or incidents. IT Partner specialists then analyze the data, infrastructure, and logs, and finally prepare and provide the report to the client.

Yes. Log analysis for servers, workstations, and network hardware is part of IT Partner’s stated responsibility, because suspicious activity often leaves traces in system and infrastructure logs. The value of the review depends on the logs and incident information the client can provide.

There are no formal prerequisites listed for this service. However, the client is responsible for providing necessary information about existing hardware, servers, and workstations, assigning a dedicated point of contact, and coordinating any outside vendor resources and schedules.

No — the work is investigative analysis of infrastructure, logs, and security data. Systems keep running normally; any remediation actions that could affect availability are scoped and approved separately.

The stated scope is incident investigation, analysis, reporting, and recommendations. Malware removal, crypto miner eradication, data restoration, or implementation of proposed solutions is not explicitly included, so those activities should be treated as separate unless IT Partner confirms they are required for investigation and within scope.

After completion, the client receives the report with incident information and recommendations to improve safety and prevent similar incidents. Implementing products, services, or solutions proposed in the report is not included in this service, so follow-up remediation should be planned separately if needed.