Incident Response and Forensics

The expensive hours in an incident are the ones spent deciding who is allowed to decide.

The technical containment is usually the fast part. What stretches an incident from hours into days is that nobody agreed in advance who can take a production system offline, who signs the CERT-In report, and who calls the customer. Each of those becomes a meeting.

Where SECCOM stops. SECCOM runs containment, evidence handling and the reporting timeline alongside your team. SECCOM does not hold a digital-forensics accreditation and will not claim one. Where an incident becomes a legal or regulatory matter, SECCOM names the qualified people who take it from there and hands over a custody record they can use.