Incident Response and DFIR
Contain the threat. Understand the impact. Recover with confidence.
If your organization is dealing with ransomware, a compromised mailbox, account takeover or a data breach, call our 24/7 incident line at 1-650-300-7557. You do not need to be an existing client. We contain the threat, find out what happened through in-house forensic investigation and help you return to normal operations in a controlled way.
- 24/7 incident line
- Help for clients and non-clients
- In-house forensic investigation
- Chain of custody
- Coordination with insurers and counsel
Active incident? Call the 24/7 incident line now at 1-650-300-7557. Disconnect affected devices from the network, but do not wipe them or power them off unless we advise it, and do not email evidence to anyone. For a plain-language overview, see Have you been compromised?
Incident response at a glance
What ACS Cyber incident response is and who it is for
Incident response is the work of containing a cyberattack, finding out what happened and restoring trusted operations. Digital forensics and incident response (DFIR) adds the evidence-based investigation that shows how the attacker got in, what they reached and what data may be affected.
ACS Cyber, the MSSP and cybersecurity division of Atlantic Computer Systems, provides incident response and DFIR for small and midsize organizations nationwide. Forensic investigation is performed in-house, with documented evidence handling and chain of custody.
To start, call the 24/7 incident line. Clients and non-clients can call, and triage begins on that first conversation.
In brief
| Question | Answer |
|---|---|
| Who can call? | Anyone dealing with an active incident, client or not |
| How do we reach you? | The 24/7 incident line, 1-650-300-7557 |
| Who investigates? | Our in-house forensic investigators |
| How is evidence handled? | Documented collection and handling, with chain of custody |
| Our insurer assigned a firm. Can you still help? | Yes, we work alongside it where your policy permits |
| What happens afterward? | Hardening, in-house penetration testing to validate fixes, and optional 24/7 MDR |
While you call
First steps that protect your options
These steps help limit damage and preserve the evidence an investigation depends on. We will confirm what applies to your situation on the call.
- Disconnect affected devices from the network, by unplugging the cable or turning off Wi-Fi, instead of powering them off
- Leave affected systems as they are: do not wipe, reimage or restore them yet
- Do not delete suspicious emails, and record malicious inbox rules or forwarding before you remove them
- Communicate from a phone or device you believe is unaffected, not from email that may be compromised
- Check your cyber-insurance policy for notification steps and contact your insurer
- If money may have been sent to a fraudulent account, contact your bank right away
- Write down what you noticed, when and who has been told
- Involve your legal counsel early, especially if sensitive data may be affected
Incident types
Incidents we respond to
Whatever the starting point, the goal is the same: stop the damage, establish the facts and restore trusted operations.
Ransomware
Encrypted systems, stolen data or an extortion demand. We contain the spread, preserve evidence, assess what was taken and plan restoration from clean sources.
Business Email Compromise
A compromised or impersonated mailbox used for invoice fraud, wire fraud or payment redirection. We remove attacker access and investigate what was read, sent and changed.
Account takeover
An attacker signing in as one of your users, often after a phishing email. We revoke sessions, restore control and establish what the account was used to reach.
Malware
Malicious software on endpoints or servers. We identify how it arrived, what it did and whether it spread before removing it.
Unauthorized access
Someone in your network, applications or remote-access tools who should not be there. We investigate how they got in and close the path.
Data exposure
Sensitive information accessed, shared or published without authorization. We investigate what was exposed, how and for how long, so counsel has the facts.
Insider incidents
Misuse of access by a current or former employee or contractor. We investigate discreetly, in coordination with your counsel and HR.
Cloud and Microsoft 365 incidents
Suspicious tenant changes, malicious app consents, mass downloads or rogue inbox rules in Microsoft 365, Google Workspace, Azure or AWS.
Our methodology
How we respond, step by step
Every incident is different, but a consistent method keeps decisions clear under pressure. Steps often overlap, and we report progress to your team throughout.
01
Triage
We gather the essential facts on the first call: what you are seeing, which systems and accounts are affected and what has already been done. We advise on immediate protective steps and agree on who needs to be involved.
02
Scope
We determine how far the activity reaches across endpoints, servers, identities, email and cloud services. A clear scope keeps the response focused and avoids disrupting systems that are not affected.
03
Contain
We isolate affected devices, revoke attacker sessions and block malicious access while preserving evidence. Containment is coordinated with your team so critical operations stay protected.
04
Investigate
Our in-house forensic investigators collect and analyze logs, endpoints, mailboxes and cloud audit data, with documented evidence handling and chain of custody. The goal is a reliable timeline, a confirmed root cause and an evidence-based view of what data may have been accessed.
05
Eradicate
We remove the attacker’s footholds, including malware, persistence mechanisms, rogue accounts, inbox rules and unauthorized applications. Then we close the path they used to get in.
06
Recover
We restore systems and data from trusted sources in a planned order and validate that they are clean. Monitoring stays heightened for signs that the attacker is trying to return.
07
Strengthen
We deliver our findings and a prioritized hardening plan, then help you carry it out. Our in-house penetration testers can retest the fixes to check that the path the attacker used is closed.
What is included
Forensic depth with practical outcomes
DFIR answers two questions at once: how do we stop this, and what actually happened? ACS Cyber performs forensic investigation in-house, so the people containing the incident and the people analyzing the evidence work from the same facts.
Findings are written for the people who need them: technical detail for your IT team, and clear summaries for leadership, counsel and insurers. See how we investigate a compromise.
- Evidence preservation with documented handling and chain of custody
- Timeline development from first access to containment
- Root-cause investigation into how the attacker got in
- Containment guidance your team can act on immediately
- Recovery planning that puts your most critical systems first
- Post-incident hardening, validated by in-house penetration testing
- Executive reporting in plain business language
- Coordination with legal counsel, insurers or other parties you authorize
In-house forensic investigation
Our forensic analysis covers endpoints, servers, identity logs, mailboxes, and Microsoft 365, Google Workspace, Azure and AWS audit records.
We arrange secure evidence collection directly with your team. Please do not email logs, files, passwords or sensitive records to anyone, including us.
Insurers and counsel
Working with your insurer and legal counsel
Many cyber-insurance policies set out notification steps, and some assign or require a specific response firm. Check your policy and notify your insurer as early as you can, because the timing of notice and the choice of response firm can affect coverage.
If your insurer assigns a response firm, we work alongside it where your policy permits, for example on containment, recovery and the IT work that follows. With your authorization, we also coordinate with your breach counsel and share facts as they are established. If counsel directs the investigation, we work under that direction.
We provide technical facts, not legal conclusions. Decisions about notification, regulatory reporting and public communication belong to your leadership, working with your legal counsel.
Who does what
| Party | Typical role |
|---|---|
| Your leadership | Business decisions, approvals and communications |
| ACS Cyber | Containment, forensic investigation, recovery and hardening |
| Your legal counsel | Legal advice, including on notification, and, if they choose, direction of the investigation |
| Your insurer | Coverage guidance, the claims process and any assigned response firm |
| Your IT team or provider | System access, operational knowledge and remediation support |
Recovery
Recovery is handled by the same organization
Atlantic Computer Systems provides managed IT, and ACS Cyber is its cybersecurity division. Our responders work alongside IT engineers in the same organization who restore servers, rebuild endpoints, reconfigure Microsoft 365 and validate backups, so recovery follows directly from what the investigation found. Atlantic Computer Systems also provides managed cloud and backup services.
If you have an internal IT team or an existing provider, we work with them and agree on who does what. If you have no IT team of your own, Atlantic Computer Systems offers fractional IT services that can continue after recovery. Learn about Atlantic Computer Systems.
Recovery support can include
- Restoration from clean, verified backups
- Rebuilding or reimaging affected systems
- Resetting identities, credentials and access
- Reconfiguring Microsoft 365 and cloud tenants
- Heightened monitoring after systems return
- Hardening before normal operations resume
After the incident
Protect your organization so it does not happen again
Every engagement ends with a hardening plan. These services carry it forward and shorten the path from first alert to recovery if something happens again. See how we protect you after an incident.
Managed Detection & Response
24/7 monitoring by our in-house SOC, with pre-approved containment, to catch an attacker’s return or the next threat early.
Vulnerability management and penetration testing
Scanning and in-house penetration testing that check your fixes and help you find the next weakness before an attacker does.
Security Awareness Training
Practical training that helps your people spot phishing and impersonation, a common starting point for incidents.
Incident response planning and tabletops
A written plan with roles, contacts and first steps, practiced through guided scenarios such as ransomware or payment fraud.
FAQ
Incident response questions
An incident response firm contains the attack, investigates how it happened and what it affected, and guides recovery. ACS Cyber does this with in-house forensic investigation and documented chain of custody, starting with a call to our 24/7 incident line at 1-650-300-7557, client or not.
For ransomware first steps, see our ransomware response guide.
In most cases, disconnect affected computers from the network rather than powering them off. Disconnecting limits the spread while keeping evidence in memory that is lost when a machine shuts down.
Do not wipe, reimage or restore affected systems before we have discussed it. We confirm the right steps for your environment on the call.
That decision belongs to your leadership, made with your legal counsel, your insurer and, where appropriate, law enforcement. Payments can raise legal issues, such as U.S. sanctions rules, for your counsel to review. We do not give legal advice.
What we provide are the facts that inform the decision: what was encrypted or taken, whether clean backups exist, what restoration would involve and what risks remain either way.
Yes. Non-clients can call our 24/7 incident line, and you do not need an existing contract to get help. We agree on the scope and terms of the engagement with you as part of getting started.
Yes, with your authorization. We coordinate with your insurer and breach counsel and share facts as they are established, and if your insurer assigns a response firm, we work alongside it where your policy permits. Check your policy early, because some policies require a specific response firm.
ACS Cyber responds to Business Email Compromise and hacked Microsoft 365 or Google Workspace accounts through its 24/7 incident line. We remove the attacker’s access, investigate what was read, sent and changed, and help you secure the tenant.
If a payment may have gone to a fraudulent account, contact your bank immediately and file a complaint with the FBI’s IC3. See our BEC and wire fraud guide.
Triage starts on your first call to the 24/7 incident line, where we agree on next steps with you. Every incident is different, so we do not promise fixed timelines, but we move as quickly as the situation allows.
Our in-house forensic investigators collect evidence through documented methods and maintain chain of custody, so there is a clear record of what was collected, when and by whom.
We arrange secure collection directly with your team. Please do not email evidence, logs, passwords or sensitive records to anyone, including us.
That is a legal question for your counsel, and we provide the technical findings they need, such as what data was accessed and when. Obligations can arise under state breach-notification laws, the HIPAA Breach Notification Rule and other rules, and some deadlines are short, so involve counsel early. See our data breach guide.
The FBI and CISA encourage organizations to report cyberattacks, and the decision to report rests with your leadership and legal counsel. We can provide the technical details a report needs. The FBI takes reports through its Internet Crime Complaint Center (IC3), and CISA accepts incident reports at cisa.gov/report.
Incident response is a focused engagement to contain and investigate a confirmed incident, while managed detection and response (MDR) is an ongoing 24/7 service that detects and contains threats early. Many organizations add MDR after an incident so our in-house SOC can watch for the attacker’s return.
Every engagement ends with a findings summary, including the root cause where the evidence establishes it, and a prioritized hardening plan we can help you carry out. Common next steps are MDR, vulnerability management with in-house penetration testing, security awareness training and incident response planning.
24/7 incident line
Need help with an incident right now?
Call our 24/7 incident line and speak with our team, client or not. For incident response planning, tabletop exercises or post-incident hardening, book a free 30-minute consultation instead.