IRP is a fully managed incident response planning service. Guardian builds your incident response plans, or converts and enhances the ones you already have, and maintains them on a dedicated incident response platform. Plans are structured as workflows your team executes from, rather than static documents.
The platform is out of band, so your plans stay accessible if your network is compromised. It’s available on any device.
01 · Guardian IRP
What IRP Covers
Plan Development
Each plan is built as a guided workflow with predefined forms, checklists, and timers. Existing plans in Word, PDF, presentation, or spreadsheet format are converted and enhanced to run on the platform. New plans are built from templates.
Scenario Coverage
Plans cover disaster recovery and the following incident types: business email compromise (BEC) with and without funds transfer, corporate account takeover (CATO) and impersonation, corporate espionage, denial of service, malware detection, policy violation, ransomware and extortion, stolen or lost assets, third-party compromise, unauthorized access or intrusion, unintentional data loss or leakage, website compromise, and zero-day notification.
Tabletop Exercises
Drills run on the same workflows your team would use in a real event, with a different scenario each time. Each function trains on its own role: Incident Response Commander, SOC, IT Operations, IT Management, Communications, Public Relations, Finance, Human Resources, and Legal. Gaps surface during the exercise, where they can be fixed and refined before a real event.
Plan Review
Plans are typically reviewed annually, or more often where your regulatory requirements or internal policies call for it.
02 · Guardian IRP
How It’s Managed
Guardian builds your plans with you or converts the plans you already have. Plan development involves the people who would be part of a real response: leadership, legal, sales, your IT team or MSP, and any other stakeholders. Your insurance provider is often part of planning and tabletop exercises as well.
Guardian recommends tabletop exercises at least quarterly, so every function has practiced its role before a real event.
03 · Guardian IRP
How IRP Fits
IRP covers planning, documentation, and tabletop exercises. Your IT team or MSP is part of plan development, so the plans reflect how your environment actually runs.
Incident response is a separate service, Guardian Phoenix, available to existing Guardian customers.
04 · Guardian IRP
Cybersecurity Safe Harbor Protection
Where safe harbor documentation calls for an incident response plan, IRP can provide that plan as part of the documentation driven by Guardian Lumen.
Safe harbor is an affirmative defense, not immunity. Guardian advises all clients to consult qualified legal counsel regarding their specific state obligations and eligibility.