By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics
Why Middle Market Companies and Regional Enterprises Face Disproportionate Breach Risk
Mid market companies, regional utilities, healthcare groups and growing professional services firms hold the exact same high value financial accounts, employee records and B2B network connections as Fortune 500 giants, yet rarely maintain a twenty four hour internal Security Operations Center or an in house digital forensics lab. When a ransomware attack or business email compromise strikes a mid market enterprise on a Friday evening before a holiday weekend, leadership without a pre arranged incident response plan and retainer is forced to scramble blindly while critical cloud and firewall logs overwrite.
Practical Incident Response Playbooks, Tabletop Exercises and Priority Retainers
Global Digital Forensics levels the playing field for mid market and enterprise organizations through our forensic readiness and incident response planning and incident response retainer programs. Working with your general counsel, IT director and executive team, we build a concise, actionable incident response plan that defines exact first hour preservation steps, legal privilege protocols, cyber insurance notification contacts and IT isolation procedures. We test that plan alongside your leadership in realistic tabletop exercises and back it with 24/7 priority dispatch of our veteran forensic examiners and incident responders whenever you need us.
What an Incident Response Plan Must Contain When There Is No Security Operations Center
A plan for a company without a security team is a short document that answers who does what in the first hours, and it is tested by whether a manager can follow it at two in the morning. It names the incident lead, usually the IT director or the operations executive, and the decision maker who can authorize shutting down systems, engaging outside help and spending money, with a deputy for each. It states that outside counsel is called first, before the insurer, the managed service provider or the forensic firm, so that the rest of the response proceeds under direction of counsel, and it lists the counsel, the insurer's claims line with the policy number and the forensic retainer contact with their numbers in a place that is reachable when email and the file server are down. It describes how the team communicates when the corporate systems cannot be trusted, through personal phones and a prearranged channel.
The plan then tells the first responders what to do with the systems. It instructs them to isolate affected machines from the network rather than power them off, to leave the ransom note and any attacker artifacts in place, to stop backups from overwriting and to touch nothing else until the forensic contact has spoken with them. It identifies where the logs live, including the firewall, the identity provider, the email tenant, the endpoint agent and the backup system, and who has the credentials to export them. It contains the inventory of systems and data that matters most, the list of customers and partners who have contractual notification rights, and the state and sector notification obligations counsel will need to assess. Finally, it sets the recovery order and the conditions under which systems may be rebuilt, which is after images have been taken. Our forensic readiness and incident response planning engagement produces exactly this document and then tests it.
The Frameworks Behind the Plan and What They Ask of a Smaller Company
The structure above is not improvised. NIST SP 800-61 Revision 3, published in 2025, reorganizes incident response around the Cybersecurity Framework 2.0 functions of govern, identify, protect, detect, respond and recover, and makes the point that preparation is a governance activity that happens long before an incident. For a smaller company that means deciding in advance who leads, what gets logged, how long logs are kept, where backups live and who is on retainer, rather than discovering those gaps during the event. The Federal Trade Commission's small business cybersecurity guidance covers the same ground in plainer language, and the agency's enforcement history makes clear that a company's size does not excuse the absence of reasonable security and a response capability.
For ransomware specifically, the CISA StopRansomware resources set out the preparation, detection and response steps the federal government recommends, including maintaining offline backups, enabling multi factor authentication, keeping systems patched and reporting incidents. We use those frameworks as the reference points in a readiness engagement because they are what regulators, insurers and litigants will later measure the company against. The engagement itself maps the company's actual logging, retention, backup and access controls against them, writes the plan, and then walks the leadership team through a tabletop exercise built on a realistic scenario so that the gaps appear in the conference room rather than in the incident. The incident response retainer then puts the examiner who did that work on call.
Cyber insurance policies are the third reference point, and the least read. Most policies require notice to the carrier within a defined period, approval of forensic and legal vendors before expenses are incurred, and cooperation with the carrier's panel, and many exclude costs incurred before notice is given. The plan should state the policy number, the claims line and the notice window, and the readiness review should confirm that the forensic retainer the company has chosen is acceptable to the carrier or that the carrier's panel includes it. Companies that discover these terms during an incident lose coverage for the first and most important hours of work. Those that read them in advance have a plan the insurer will fund and a response that starts without a negotiation.
The First Day of an Incident Without a Security Team
The first hour belongs to isolation and the phone. Affected systems are disconnected from the network, not powered down, so that memory and running processes survive for capture. The incident lead calls counsel, and counsel or the lead calls the forensic retainer line. The insurer is notified according to the policy's terms, which often require notice before certain expenses are incurred. No one pays, negotiates, rebuilds or runs cleanup tools. The second through fourth hours belong to preservation under the examiner's direction: exporting the firewall, VPN, identity and email tenant logs before they roll over, capturing memory from the affected servers, imaging the systems that matter most and securing the backups so they can neither be encrypted by the attacker nor overwritten by a well meaning restore. Each step is recorded with who did it and when.
The rest of the day is scoping and the first decisions. The examiner identifies the initial access path as far as the record allows, the accounts and systems touched, whether data was staged or exfiltrated and whether the attacker still has a foothold, and reports that to counsel and leadership in plain language. Those findings drive the decisions that cannot wait: whether the business can run on manual processes, which systems to restore first and from which backups, what to tell customers and employees and whether law enforcement should be contacted. Our ransomware and data breach analysis engagement continues from there into the full reconstruction and the notification analysis. The guide to preserving volatile evidence explains why the order of these steps matters, and our digital evidence mistakes guide covers what happens when it is reversed.
The Decisions That Cost Mid Market Companies the Most
Rebuilding before imaging is the most expensive error, and it is made constantly, because the pressure to restore operations is immediate and the forensic cost is abstract. A server wiped and restored from backup on Saturday cannot tell anyone on Monday how the attacker got in, whether data left or whether the backup itself carries the attacker's persistence, and the company is left unable to answer the insurer, the regulator or the customers. Paying a ransom without preserving the record is the same error with a larger invoice, because the decryption key does not explain the intrusion or close the door. Relying on the managed service provider alone is a quieter version: the provider's interest is in restoring service, its logs may be on systems the company does not control, and its staff may have been the path in.
Log retention decided by default is the error that makes the others permanent. A firewall keeping two weeks of logs, an email tenant on a license tier with short audit retention and endpoints with no agent at all leave the examiner describing gaps rather than facts, and the notification analysis defaults to assuming everything was exposed. Not knowing the insurer's requirements until the incident leads to denied expenses and missed deadlines. Having no out of band contact list leaves the team unable to reach each other when email is down. None of these is a technology problem. They are decisions that a readiness engagement surfaces and a plan resolves, and the cost of resolving them in advance is a fraction of the cost of one incident handled without them. The hotline at (800) 868-8189 answers at any hour, and the conversation that puts a plan in place starts with a free consultation.
Put Global Digital Forensics on Your Speed Dial Before an Emergency Strikes
Read our guide to the five digital evidence mistakes counsel must avoid right now, and call Global Digital Forensics at (800) 868-8189 to establish your incident response plan and retainer today. The initial consultation is free.
What an Incident Response Plan Must Contain Without a Security Team
The guide describes a plan short enough to follow at two in the morning, tested by whether a manager can act on it. This table lists what the plan must contain, the decision or contact it fixes and why it belongs there, so a mid market leadership team can see what preparation actually settles. Read the why column, because most of these are decisions that a readiness engagement surfaces and a plan resolves. The first call is to counsel, so the rest of the response proceeds under direction of counsel.
| Plan element | What it fixes | Why it belongs there |
|---|---|---|
| Named incident lead and decision maker | Who acts and who can authorize spending | Removes hesitation in the first hour |
| Call counsel first | The order of the first calls | The rest proceeds under direction of counsel |
| Counsel, insurer and retainer contacts | Reachable numbers when systems are down | Policies require prompt notice and vendor approval |
| Isolate rather than power off | What first responders do with machines | Preserves memory and running processes |
| Where the logs live and who can export them | The sources and their credentials | Volatile logs roll before they are found |
| Notification rights and obligations | Customers, partners and regulators to assess | Counsel needs the list to judge duties |
| Recovery order after imaging | When systems may be rebuilt | Rebuild before imaging destroys the record |
The internal corporate fraud case study shows how missing logs from recently changed systems limited what could be reconstructed, the preparation gap an incident response plan and retainer are meant to close before an emergency.
How to Begin and What Happens on the First Call
If an incident is under way, have ready what has been observed and when, which systems are affected, what has already been done, who your counsel and insurer are and whether a managed service provider is involved. If you are planning ahead, have ready a description of your systems, your email platform, how backups work, who would lead a response and any contractual or regulatory obligations you know of. The examiner asks about logging and retention, remote access, multi factor authentication and who holds administrative credentials. You then receive a written scope describing either the immediate response steps or the readiness review, the plan and the tabletop exercise, with timing and a proposal for the engagement or the retainer. The initial consultation is free, and the hotline at (800) 868-8189 answers 24/7.
Technical References and Further Reading
Related GDF pages for this work: cyber security solutions and comprehensive penetration testing.
The original article pointed readers to Cyber Attacks: 5 Ways Small Businesses Can Protect Themselves. Those references are kept for the record.
Authorities cited in this guide: NIST SP 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management. Reorganizes incident response around the Cybersecurity Framework 2.0 functions and treats preparation as governance, final version published 2025. NIST Cybersecurity Framework 2.0. Defines the govern, identify, protect, detect, respond and recover functions the plan is organized around, version 2.0 published 2024. Federal Trade Commission, Cybersecurity for Small Business. The FTC's plain language guidance on reasonable security practices and incident response for smaller companies, current agency page. CISA StopRansomware. Federal guidance on preparing for, detecting and responding to ransomware, including backups, multi factor authentication and reporting, current agency site.