Incident Response Readiness Assessment
17 administrative controls scored against NIST SP 800-61 Rev. 3 and your frameworks, with a risk register and a 90-day roadmap.
Would your team know who decides in the first hour?
Who can shut systems down, call the insurer or bring in counsel? Most gaps we find are decisions nobody wrote down.
Findings mapped to the frameworks you report on
HIPAA, PCI DSS, SOC 2, ISO/IEC 27001, the FTC Safeguards Rule and your cyber insurer all ask for a tested plan.
An incident response readiness assessment before you need one
The incident response readiness assessment measures whether your business could respond to a cyber incident or a major outage today: who decides, who is called, what evidence survives, and how fast the business can work again.
It is read-only and takes little of your team’s time: a document request, short interviews and a walkthrough of the results. Businesses in Irvine and across Orange County and Southern California can have it on-site; it runs remotely nationwide.
The 17 controls in the assessment
Administrative controls: the people, decisions and documents that make a response work. Each is rated Missing, Partial, Documented or Tested.
| # | Control | What good looks like | Evidence we review |
|---|---|---|---|
| 01 | Incident response policy | Approved by leadership, reviewed every 12 months | Signed policy, review date |
| 02 | Roles and decision authority | Incident lead and alternates named; who may shut systems down, call counsel or the insurer | RACI chart, delegation memo |
| 03 | Severity levels and activation | Clear triggers for declaring an incident and for each severity | Severity matrix in the plan |
| 04 | Contact and escalation sheet | Staff, IT provider, insurer hotline, breach counsel, forensic firm, bank, FBI IC3; also kept offline | Dated contact sheet, quarterly check |
| 05 | Notification decision tree | Every legal and contract deadline that could apply, with an owner for each | Deadline register reviewed by counsel |
| 06 | Scenario playbooks | Step lists for your likely incidents, including outages that are not attacks | Playbooks with version numbers |
| 07 | Evidence preservation and log retention | Logs kept long enough to investigate; legal hold and chain-of-custody steps | Retention standard, log-source inventory |
| 08 | Out-of-band communications | A way to talk if email, Teams or phones are down or compromised | Alternate channel list, test record |
| 09 | Emergency (break-glass) access | Emergency admin access that does not depend on the systems that may fail | Procedure, last test date |
| 10 | Business impact analysis | Critical processes and systems ranked; recovery targets set by the business | BIA signed by system owners |
| 11 | Backup and restore program | A separate or immutable copy; restores tested on an agreed schedule | Restore-test records |
| 12 | Continuity and DR plans | Recovery order, downtime procedures and manual workarounds | DR plan, downtime forms |
| 13 | Vendor and cloud resilience | Dependency map; vendor incident-notice clauses; outage plans for key SaaS | Dependency map, contract clause review |
| 14 | Cyber insurance alignment | Plan matches policy conditions and notice requirements | Policy summary matched to evidence |
| 15 | Training and exercises | Responders trained; at least one tabletop a year | Attendance, scenario, after-action report |
| 16 | Post-incident review | Every incident and exercise ends with dated fixes and a plan update | Lessons-learned records, change log |
| 17 | Incident register and reporting | Every event logged; leadership sees trends and open fixes | Register, quarterly leadership report |
How each control is rated
| Rating | Meaning |
|---|---|
| Missing | Nothing in place, or only in someone’s head |
| Partial | Something exists but is incomplete, out of date or not approved |
| Documented | Written, approved and current, but not yet tested |
| Tested | Exercised in a tabletop, restore test or real event, with records and follow-up |
Auditors and insurers look for the last column: proof that the control worked when it was tried.
What a finding looks like
- Control
- 05 · Notification decision tree
- Rating
- Missing High
- Finding
- No one owns the decision to notify patients, the HHS Office for Civil Rights or California residents, and the deadlines are not written down anywhere.
- Why it matters
- The HIPAA Breach Notification Rule and California Civil Code 1798.82 set deadlines that start at discovery. Without an owner, days are lost before counsel is even called.
- Recommendation
- Add a one-page decision tree to the plan that lists each deadline, who decides with counsel, and who files. Review it with counsel once a year.
- Frameworks
- HIPAA 164.308(a)(6); FTC Safeguards Rule 314.4(h) where it applies; NIST CSF 2.0 RS.CO
Frameworks the assessment maps to
| Framework or rule | What it expects |
|---|---|
| NIST SP 800-61 Rev. 3 and NIST CSF 2.0 | Incident response built into all six CSF functions: Govern, Identify, Protect, Detect, Respond and Recover |
| HIPAA Security Rule, 45 CFR 164.308(a)(6) and (a)(7) | Security incident procedures; contingency plan with data backup, disaster recovery and emergency mode operation plans; periodic testing |
| PCI DSS v4.0.1, Requirement 12.10 | An incident response plan ready to activate, reviewed and tested at least once every 12 months, with trained responders |
| SOC 2 Trust Services Criteria | CC7.3 to CC7.5 (evaluate, respond, recover) and availability criteria A1.2 and A1.3 (recovery and its testing) |
| ISO/IEC 27001:2022 Annex A | 5.24 to 5.28 incident management, 5.29 security during disruption, 5.30 ICT readiness, 8.13 backup |
| FTC Safeguards Rule, 16 CFR 314.4(h) | A written incident response plan covering goals, processes, roles and decision authority, communications, remediation, documentation and plan revision |
| SEC Regulation S-P (2024 amendments) | A written incident response program and oversight of service providers that hold customer information |
| CCPA cybersecurity audit regulations | The audit covers how the business responds to security incidents and its business continuity and disaster recovery plans |
| Cyber insurance | Applications and renewals commonly ask for a written plan, tested backups and an incident contact process; terms vary by carrier |
Sources: NIST SP 800-61 Rev. 3, 45 CFR 164.308, 16 CFR 314.4, Cal. Civ. Code 1798.82. This page is general information, not legal advice; your counsel decides which rules apply.
Four reports and a framework mapping
| Deliverable | What it contains | Who uses it |
|---|---|---|
| Executive readiness report | Overall readiness, the top risks and what to fund first | Owner, CEO, board |
| Control scorecard | All 17 controls with their rating and evidence | IT manager, compliance lead |
| Risk register | Business risks rated by likelihood and impact, tied to findings | Compliance, insurer, auditors |
| 90-day roadmap | Actions in order with owners | IT manager, vCISO |
| Framework mapping | Each control mapped to your frameworks | Auditors, assessors |
What we do not promise
- We do not promise data retention periods, restore times or recovery outcomes. Recovery targets, retention and restore testing are discussed and agreed with you, and depend on your systems and providers.
- Our role is advisory. Decisions about your systems, and their operation, stay with you and your IT providers; engagement terms are set in a written proposal before work starts.
- We do not resell any application or product, so our recommendations stay vendor-neutral.
- Legal and notification decisions belong to your counsel. Litigation-grade forensic investigations are done by a qualified forensic firm engaged through your counsel.
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every engagement is evidence-based, so leadership, IT and outside counsel can act on the same facts.
Readiness assessment questions
What does the incident response readiness assessment cost?
$3,500 fixed. The scope is confirmed in a written proposal before work starts.
How long does it take?
It depends on how quickly documents and interviews can be scheduled; we agree the timeline with you at the scoping call.
Do you need access to our systems?
No admin access is needed. We review documents and evidence you provide, interview your team, and look at read-only screenshots or reports where useful.
We do not have an incident response plan yet. Should we start here?
Yes. The assessment shows which controls are missing and in what order to build them. The Incident Response Plan and Playbooks service can follow.
Do you guarantee that we will pass an audit or recover from an incident?
No. The assessment measures readiness and gives a prioritized roadmap. Recovery targets and outcomes are agreed with you and depend on your systems and providers.
Which frameworks do you map to?
NIST SP 800-61 Rev. 3 and NIST CSF 2.0 as the baseline, plus the frameworks you report against: HIPAA, PCI DSS, SOC 2, ISO/IEC 27001, the FTC Safeguards Rule, SEC Regulation S-P or the CCPA cybersecurity audit regulations.
From findings to working controls
OC Security Audit supports you through the audit. If you need it, IT Perfection, a managed IT business also owned by Ali Hassani, can help with installation and ongoing support. Using it is optional, and we do not resell any application or product.
Find the gaps before an incident finds them
Schedule a consultation. The incident response readiness assessment is $3,500 fixed.
Read-only, independent and vendor-neutral. On-site across Irvine, Orange County and Southern California; remote nationwide.