CIRT

How it works

• Members know the systems, the people and the plan.
• They decide what to isolate, who to tell and when to restore.
• They keep notes for insurers, regulators and lessons learned.
• Small firms rarely have one and borrow it from their IT provider.

What can go wrong (example scenario)

A small accounting office discovered ransomware on a Friday evening. With no named response team and no call list, nobody knew who could shut off the file server until the next morning.

How WILDCARD handles it

vCIO helps write the response plan and call list, and alerts from Identity Monitor and Workstation Defender are investigated around the clock.

• A written plan names who calls the insurer and who disconnects machines.
• A practice exercise tests the call list once a year.
• A post-incident review turns into three changes to the plan.

A question owners ask

Does a small business need its own team?

Not a full one. It needs a named person, a short plan and a provider who can step in fast.