Skip to content
Book a consultation
МКEN

Incident response & forensics

Incident response and forensics: preparation, control and evidence

An incident is the worst moment to work out who does what. We help you prepare before it happens and work alongside your team when it does: establishing what happened, containing it under your control, preserving evidence properly, restoring operations and working through the reporting steps of the NIS2-aligned law.

Book a consultationHow it works
  1. 01PreparationPlans, roles, exercises and tooling before an incident happens.
  2. 02Detection & analysisConfirm, scope and prioritize the incident.
  3. 03Containment & recoveryIsolate, eradicate the threat and restore operations safely.
  4. 04Post-incidentLessons learned and stronger defenses.
Incident response lifecycle (the classic model from NIST SP 800-61r2)

Incident response & forensics

What you get

01

Ready before it starts

A written plan, scenario playbooks and rehearsed roles mean your people know who decides, who acts and who informs whom from the very start.

02

Containment you control

We propose each containment step together with its business impact. Nothing disruptive happens without your approval, and every action is logged with who approved it and when.

03

Evidence you can rely on

We collect and preserve digital evidence following ISO/IEC 27037, with a documented chain of custody that supports regulatory, insurance or legal follow-up.

04

Clear regulatory reporting

We help you prepare the first notice, early warning, notification and final report the law requires, with facts drawn from a single incident timeline.

What's included

  • Incident response plan, roles and escalation paths aligned with NIST SP 800-61 and ISO/IEC 27035
  • Playbooks for likely scenarios such as ransomware, business email compromise, taken-over accounts and data leaks
  • Tabletop exercises in which management and technical teams rehearse the decisions an incident forces
  • Incident coordination: triage, scoping, severity and containment decisions made together with you
  • Digital forensics on endpoints, servers, email and cloud accounts, with a preserved chain of custody following ISO/IEC 27037
  • Eradication and recovery: removing attacker access, resetting credentials and restoring from clean backups
  • Support with the 3-hour first notice, 24-hour early warning, 72-hour notification and one-month final report under the NIS2-aligned law
  • Post-incident review with a timeline, root cause and a prioritized improvement plan

How we work

  1. 01

    Prepare

    We review or write your incident response plan, build playbooks for the scenarios that matter to you and run tabletop exercises. With a retainer, contacts, access and log sources are agreed in advance.

  2. 02

    Detect and analyze

    We confirm whether the incident is real and establish its scope and severity. Forensic analysis shows how the attacker got in and what they touched, mapped to MITRE ATT&CK. We also help you judge whether it must be reported and record when you became aware of it.

  3. 03

    Contain

    We preserve volatile evidence, such as memory, first. Then we propose containment steps with their impact and, where possible, a way to roll them back. Each step runs only after you approve it.

  4. 04

    Eradicate and recover

    We remove the attacker’s access and persistence, close the entry point and support a staged return to normal operations, while watching for signs that the attacker is trying to come back.

  5. 05

    Review and improve

    A post-incident review sets out the timeline, root cause and lessons learned. The improvements feed into your plan, your controls and the final report to the competent CSIRT.

Who it's for

  • Organizations that want a tested plan and a team to call before they need one
  • Essential and important entities with incident handling and reporting duties under the NIS2-aligned law
  • Banks and financial firms, including local subsidiaries of EU groups that apply DORA’s ICT incident rules
  • Organizations facing an incident now that need forensics, recovery and an independent account of what happened

Frameworks and standards

  • NIST SP 800-61 Rev. 3
  • ISO/IEC 27035
  • ISO/IEC 27037
  • MITRE ATT&CK
  • NIS2-aligned law of North Macedonia

Frequently asked questions

We think we have an incident right now. What should we do?
Contact us and describe what you have seen. Until we speak, do not switch off or wipe the affected systems, because that destroys evidence held in memory. If you must stop the spread, disconnect them from the network rather than from power, keep the logs, and write down when you first became aware of the problem: under the NIS2-aligned law, that moment starts the reporting clock.
What is an incident response retainer?
It is an agreement made before anything goes wrong. We agree the scope, escalation contacts, communication channels and access in advance, and the retainer can also cover preparation work such as plan reviews and tabletop exercises. When an incident happens, you are not negotiating a contract while the clock runs. A retainer is optional, and you do not need to be a managed SOC client. Terms depend on your size and needs, so we prepare an offer after a short conversation.
How do you help with reporting under the NIS2-aligned law?
For a significant incident, North Macedonia’s law requires a first notice to the competent CSIRT within three hours of becoming aware of it, an early warning at 24 hours, an incident notification at 72 hours, an intermediate report on request, and a final report one month after the notification. The three-hour step has no equivalent in the EU directive, which starts with an early warning at 24 hours. We help you assess whether an incident is significant and prepare the facts and draft text for each step. The duty to submit stays with you.
Why does chain of custody matter?
If an incident leads to a dispute, an insurance claim, a regulatory inquiry or criminal proceedings, you may need to show that the evidence was not altered. Following ISO/IEC 27037, we identify, collect, acquire and preserve evidence with verified copies and hash values, and we record who handled each item, when and why.
What happens in a tabletop exercise?
We walk your management and technical teams through a realistic scenario, such as ransomware over a weekend or a compromised email account used for payment fraud, and ask them to make the decisions they would face. It is a discussion, not a live test of your systems. The result is a short list of gaps in your plan, roles and contacts, which we help you close.

Guides

Related services

Managed SOC 24/7Round-the-clock monitoring, detection and response across EMEA, with AI-assisted triage and analysts who make the final call.Learn moreNIS2 complianceScoping, gap assessment and readiness for North Macedonia’s NIS2-aligned law, from portal registration to incident reporting.Learn morePenetration testing & red teamingManual testing of networks, applications, cloud and people, with CVSS-rated findings, clear reports and a retest of fixes.Learn more

Let’s talk about your security

Tell us what you need: 24/7 monitoring, testing or readiness for the NIS2-aligned law. In a short call we will agree on scope and next steps.

Book a consultation+389 75 340 034

Mon–Fri 09:00–17:00 · SOC 24/7 · info@diverto.mk