A plan nobody has ever run under time pressure is a document, not a capability. We build your incident response plan and ransomware playbooks around how your business actually works, then put your team through a facilitated exercise to find out where it breaks while it is still cheap to fix.
This engagement has two halves that only work together. First we build the incident response capability: a plan sized to your organisation, playbooks for the scenarios you are actually likely to face, a defined escalation matrix, delegated decision authority, and a workflow for assessing and meeting the personal data breach notification duty. Second we test it, by putting your team through a facilitated exercise with timed injects and watching what happens.
Testing runs at two levels depending on who needs to be ready. An operational exercise puts the response team through detection, triage, escalation, containment and evidence handling. An executive tabletop, most often built around a ransomware scenario, puts leadership through the business decisions: whether to halt production, whether to pay, what to tell customers and staff, when to notify the Commissioner, and who has authority to make each of those calls.
Nothing touches production. Exercises are discussion-based and driven by injects rather than by activity in your environment, so there is no risk to live systems and no need for a maintenance window. If a real incident starts during a session, we stop immediately so your team can deal with it.
Plans fail in predictable ways under real conditions. The escalation contact has left the company. The plan itself lives on the file server that has just been encrypted. Two people each assume the other called the CEO. Nobody is certain who has authority to disconnect a revenue-generating system, so nobody does, and the intrusion spreads for another six hours while people look for someone to ask.
Timing is now a compliance question as much as an operational one. Under the PDPA as amended a personal data breach must be notified to the Commissioner, and affected individuals told where significant harm is likely. Meeting that requires determining within hours whether personal data was involved, whose, and how many records. That determination is very hard to make for the first time at eleven at night during a live incident.
Ransomware has also changed shape, which is why the executive layer matters. Modern operations steal data before encrypting it, so an organisation with perfect backups still faces an extortion demand over publication. Restoring systems solves the outage but not the disclosure, and the disclosure is what creates the regulatory exposure. Whether to pay is a board decision involving legal exposure, insurance conditions, sanctions considerations and reputation, and boards that have never discussed it will discuss it for the first time at their worst moment.
Scoped to what you already have. Organisations with no plan start at the beginning; those with a plan usually need it modernised and tested rather than rewritten.
A plan sized to your organisation: definitions and severity levels, roles and responsibilities, a reporting route staff can actually use, escalation thresholds and delegated decision authority. Short enough to be usable at two in the morning, which most plans are not.
Step-by-step playbooks for what you are likely to face: ransomware, business email compromise and fraudulent payment, account takeover, insider data theft, third-party or supplier compromise, and lost or stolen devices.
A decision workflow for determining whether an incident is a notifiable personal data breach, who decides, what evidence is needed, and how the notification is prepared and filed inside the window. Usually the single biggest gap we find.
Timed injects testing the response team on detection, triage, escalation, containment, evidence handling and coordination between IT, legal, HR and communications. Complications are introduced deliberately: a key person unreachable, contradictory information, an early media enquiry.
A facilitated workshop putting leadership through the business decisions: continuity and manual workarounds, the ransom position, crisis communication to staff, customers and press, recovery sequencing, and regulatory and insurance obligations.
Draft holding statements, internal staff briefings, customer notifications and a media response framework with the sequencing and approval route for each. Anything drafted calmly beats anything written during a crisis.
The value is discovering the failures in a room with coffee rather than at two in the morning with customers on the phone.
Every exercise finds stale contacts, undefined authority, missing runbook steps and dependencies nobody considered. Finding them in a facilitated session costs a day.
The most common cause of slow containment is nobody being certain they are allowed to act. Exercises force the question into the open and the answer becomes documented delegated authority.
Most boards leave with a documented position, usually conditional: a default not to pay, defined circumstances for revisiting it, and a requirement to involve counsel and the insurer before any contact with attackers.
Teams that have rehearsed the breach assessment can do it under pressure. Teams that have not lose the first day arguing about whether it is notifiable, which is the day they cannot afford to lose.
Continuity plans routinely assume recovery within twenty-four hours. Realistic ransomware timelines run to days or weeks, and confronting that gap tends to change both the plan and the backup investment.
A documented plan plus a dated exercise with closed actions demonstrates preparedness rather than policy. Insurers increasingly ask for exactly this at renewal.
Four to six weeks for plan development and a first exercise, less if you already have a plan worth testing.
We read any existing plan, escalation matrix and contact lists, and establish what would actually hurt: revenue-generating systems, operational dependencies, regulatory obligations and key contractual commitments. The document review alone usually produces findings.
We draft or rework the plan, the escalation matrix, the delegated authorities and the scenario playbooks, then refine them with your stakeholders. Sized to your organisation, because a forty-page plan at a company of ninety people will not be opened.
An exercise scenario built around your real environment and sector, with a timed inject schedule that compounds pressure. Reviewed with your sponsor but withheld from participants, since a circulated scenario tests nothing.
Injects released on schedule while a facilitator runs the session and an observer records decisions, timings and points of disagreement. We deliberately let the room reach deadlock rather than rescuing it, because the deadlock is the finding.
A structured debrief immediately afterwards while memory is fresh. Participants surface most of the substantive findings themselves, which matters, because a finding a team identifies is a finding a team will act on.
Findings become specific amendments with named owners and target dates, and we revise the plan accordingly. Most clients re-exercise annually, alternating between the operational and executive formats.
Editable documents you own, designed to be maintained by your team after the engagement ends.
The full plan with severity definitions, roles, reporting routes, escalation thresholds and delegated decision authority.
Step-by-step playbooks for ransomware, business email compromise, account takeover, insider data theft and third-party compromise.
The decision workflow, evidence checklist and draft notification templates for meeting the duty inside the required window.
A reconstruction of the exercise showing what was injected, how the team responded, where time was lost and who decided what.
Every finding with severity, root cause, recommended action, named owner and target date, in a format that can be tracked to closure.
Draft statements and notifications, plus a short readiness summary for the board or audit committee.
Any organisation with a plan that has never been tested, and any organisation without a plan at all.
Regulated sectors and organisations holding significant personal data have both the highest impact and the tightest notification obligations.
Smaller organisations run one combined exercise. Larger ones usually run a technical exercise and a separate executive tabletop, then a combined one.
Incident response is cross-functional by definition, and an exercise involving only IT tests a fraction of the real problem.
An exercise is only as good as the honesty of the debrief and the specificity of what comes out of it.
We design around governance outcomes: decision authority, escalation thresholds, regulatory assessment and board reporting. The questions we press hardest are the ones a regulator or an audit committee asks afterwards, namely who decided, on what basis, when, and where is that recorded.
Findings arrive as amendments to specific documents with named owners, not as observations. Where a gap is structural, for example an outsourced IT provider with no contractual response time, we say so plainly even though that is an uncomfortable finding to deliver.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Where an exercise reveals a competence gap rather than a process gap, follow-up training including our incident response and digital forensics course can be delivered as an HRD Corp claimable programme, subject to grant approval before delivery.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
