Skip to content
Book a risk assessment

Rapid Response.

When it's serious, a team that already knows your environment.

A retainer that puts one incident lead on your side from the first call to full recovery. Evidence is preserved, every reporting deadline is tracked, and the response time is in your contract.

Price
$290 a month retainer
Guarantee
Response time in writing
Sold
Separately, on top of any pack
Set up a retainer Check your deadlines
The first hour after you callOur targets
  1. 0:00
    You call, or Always On escalates
    A person answers the incident line, any hour.
  2. 0:15
    Your incident lead is on the line
    They already have your Groundwork, your Known Normal and your contacts.
  3. 0:30
    Containment agreed
    What to isolate, which accounts to lock, and who to tell inside the business.
  4. 1:00
    Every deadline set
    Each reporting clock that applies, with exact times, in your portal.

Then investigate, recover and report, with the same lead throughout.

Reporting deadlines

The clocks start when you find out, not when you're ready.

Pick what applies to you. Exact deadlines depend on where you operate, and Groundwork confirms yours. We track them from the first call and prepare the facts for each report. Your lawyer or privacy lead signs off.

Your business
  • National cyber agencyFrom 6 hours

    Some essential services must report a significant cyber incident within hours. The shortest clock we track is 6 hours.

    Applies if: You run an essential service
  • Financial regulator, disruption24 hours

    Tell the regulator when a disruption takes a critical operation outside tolerance. Suppliers: this is your client's clock, so your contract gives you less.

    Applies if: Financially regulated, or a supplier to one
  • Financial regulator, security incident72 hours

    Tell the regulator after becoming aware of a material information security incident.

    Applies if: Financially regulated, or a supplier to one
  • Financial regulator, operational incident72 hours

    Tell the regulator about an operational risk incident likely to have a material impact.

    Applies if: Financially regulated, or a supplier to one
  • Privacy regulator, breach report72 hours

    Many privacy laws want a personal data breach reported to the regulator within 72 hours of becoming aware.

    Applies to you
  • Ransom payment report72 hours of paying

    Where reporting is required, a ransom payment must be reported to the government within 72 hours of paying.

    Applies to you
  • Breach assessmentUp to 30 days

    Assess a suspected data breach. If serious harm is likely, tell the privacy regulator and the people affected within the deadline your law sets.

    Applies to you

Deadlines summarised in plain English. Your lawyer has the final word on what applies to you.
How a response runs

From the first call to back at work, with one lead.

Always On and Device Shield already analyse and contain. Rapid Response takes over when it's bigger than one alert.

  • Always On escalates a serious incident
  • Device Shield finds more than one device involved
  • You call the incident line
Rapid Response
One incident lead, from containment to recovery.
  1. Hour 0 to 6

    Contain

    Isolate devices, lock accounts and stop the spread. Nothing is wiped before evidence is taken.

    You get
    A containment log

  2. Hour 2 to 48

    Investigate

    How they got in, what they touched and what left the business.

    You get
    Facts for your insurer and every report

  3. Day 1 onward

    Recover

    Clean rebuilds and restores, in the order your backup policy sets, then close watching.

    You get
    Systems back, and checked

  4. Within 2 weeks

    Learn

    What happened, why, and what changes, so the same door doesn't open twice.

    You get
    A board report, a technical report and a fix list

Evidence

Evidence that stands up to your insurer, lawyers and regulators.

Every item is collected before anything is cleaned, fingerprinted so nobody can claim it changed, and logged each time it's touched.

Evidence register · Incident 2026-07Portal · Example
Example evidence register
Item What it is Collected Fingerprint
EV-01Sign-in logs, all users, last 90 days03:12SHA-256 9c1f…a07e
EV-02Mailbox audit log, finance mailbox03:20SHA-256 4be2…19d3
EV-03Device timeline, laptop NB-LT-03103:31SHA-256 e77a…c402
EV-04Memory capture, laptop NB-LT-03104:05SHA-256 1d90…6b8f
EV-05Firewall and remote access logs04:40SHA-256 7a3c…f215
Chain of custody: who collected each item, when, and every time it was opened.

For your insurer

A timeline and evidence pack in the format claims teams ask for. If your policy has an incident response panel, we work alongside it.

For your lawyers

If your lawyer engages us, our findings go to them first.

For regulators

The facts each report needs, ready before the deadline, not assembled after it.

The retainer

$290 a month, so the first call starts with answers.

Sold separately. Always On and Device Shield already include incident analysis. This is the hands-on response when it's bigger than that.

  • Set up before anything happens
    Your Groundwork, contacts, insurer details and access are loaded in advance.
  • Playbooks for your top risks
    Written from your risk register, for example account takeover, ransomware and a fake invoice paid.

Set up the response before you need it.

Groundwork gives us your crown jewels, contacts and top risks, so day one of an incident isn't spent finding them.

Book Groundwork