Cybersecurity incident response services and digital forensics
Cybersecurity incident response services contain an attack, establish what happened and restore normal operations with the evidence intact. Arke Technologies, in Johannesburg, prepares South African organisations, public bodies and schools for incidents, responds under an SLA, preserves forensic evidence and supports POPIA notification to the Information Regulator.
What cybersecurity incident response services cover
Incident response in cyber security is the organised handling of an attack or breach, from first alert to final report, whether the cause is ransomware, a mailbox hijacked for invoice fraud or a stolen laptop holding learner records. Cyber incident response is the technical work of containing, investigating, cleaning up and restoring. Cyber incident management is the coordination around it: who decides, who is told and when.
Larger organisations formalise this as a computer security incident response team (CSIRT), with named people from IT, security, legal, communications and management. Most mid-sized organisations, municipalities and schools cannot staff a full cyber security incident response team, so our team fills the technical seats while your people keep the decisions. Cyber security crisis management, the executive side of a serious incident, stays with your leadership; our responders give them the facts they need to decide.
Whatever your policy calls it (information security incident management, IT security incident management or computer security incident management), the aim is the same: limit the damage, keep the evidence and stop a repeat. Response is the last line of our cybersecurity services, not the only one.
Digital forensics and incident response (DFIR)
Digital forensics and incident response are two halves of one job: response stops the damage, forensics establishes what happened. A forensic investigation in cyber security answers what your board, insurer, auditors and the Information Regulator will ask: how did they get in, what did they touch, what did they take and are they gone?
Our cyber forensics investigation work starts with preservation: disk and memory images where they matter, Microsoft 365 audit and sign-in logs, firewall and server logs and email headers, captured before they are overwritten. Computer forensics and incident response depend on logs kept beforehand. We record the chain of custody and work from copies, in line with the ISO/IEC 27001 control on collecting evidence (ISO/IEC 27037 gives the detailed guidance), then build a timeline and a root cause. Our cyber forensics services support disciplinary processes, insurance claims and regulatory notifications. Where a matter may go to court, we agree the standard of evidence at the outset.
Comparing computer forensics companies or cyber investigation services? Analyst research from firms such as Gartner, whose incident response coverage is often searched for as a Magic Quadrant, helps compare international providers. Locally, ask how evidence is preserved, who responds and how fast under contract, and whether the provider understands POPIA notification. A cyber forensics company that cannot show its chain of custody cannot defend its findings. Computer security and forensics also belong in one team, so the people containing an incident do not trample the evidence.
Security monitoring and incident response
Security monitoring and incident response work as a pair: monitoring raises the alert, response acts on it. For clients on managed detection and response, events from Microsoft 365, Entra ID, Microsoft Defender, endpoints and firewalls flow into Microsoft Sentinel, so SIEM incident response starts with context already gathered: the user, the device, the sign-in location and what happened around it.
A security operations centre (SOC) does this monitoring at scale, and a SOC incident response process runs from triage to escalation to containment against written playbooks. We follow the same process, with one difference stated plainly: Arke does not run a staffed, always-on SOC. Monitoring is automated and continuous; human response follows your SLA.
Cyber threat intelligence and incident response strengthen each other: we map attacker behaviour to MITRE ATT&CK, check indicators against threat intelligence and feed each lesson into our detection rules. Many incidents start in a mailbox, so email security and Microsoft 365 security are often strengthened first.
Standards and frameworks we work to
NIST. SP 800-61 for incident handling, and the NIST Cybersecurity Framework for the wider programme.- ISO incident response. ISO/IEC 27035 covers information security incident management, and ISO 27001 incident response controls (Annex A 5.24 to 5.28) cover planning, assessment, response, learning and the collection of evidence. Information security incident response built this way doubles as audit evidence. See ISO 27001 readiness.
- CIS incident response. CIS Controls, Control 17 (incident response management), gives smaller teams a practical checklist.
- POPIA. Section 22 requires notice to the Information Regulator and affected people as soon as reasonably possible after a compromise. See POPIA compliance.
Some cyber insurers name approved responders or ask for accreditation such as CREST incident response membership, so read your policy wording before an incident: it can decide whom you may appoint.
Your security incident management plan
A security incident management plan should fit on a few pages and exist on paper, because the network may be down when you need it. Ours covers:
- Roles and decision rights: who declares an incident, who approves shutting systems down and who speaks publicly.
- Severity levels, with response times that match your SLA.
- Notification duties: the Information Regulator and affected people under POPIA, the South African Police Service for suspected cybercrime, and your insurer's notice period.
- Playbooks for ransomware, business email compromise, a lost or stolen device and a compromised administrator account.
- Evidence handling, so staff do not wipe the machine that holds the answers.
- One incident record. Whether it lives in ServiceNow Security Incident Response, your service desk or a controlled document matters less than having one version of the truth.
We test the plan with a tabletop exercise: a realistic scenario walked through with the people named in it, then a short report of the gaps. A virtual CISO can own the plan, and a penetration test or security assessment confirms the weakness behind an incident is closed.
Governance, procurement and continuity
- Reporting. Every significant incident closes with a written report for the audit committee, board or governing body, supporting King IV Principle 12 and, in the public sector, the accounting officer's duties under the PFMA or MFMA.
- Cost. For clients under a managed agreement, incident handling follows the scope and response times in the SLA. Preparation work (plans, playbooks, tabletop exercises and logging reviews) is quoted per project.
- Procurement. Level 1 B-BBEE contributor (sworn affidavit available on request); company documents, CSD supplier number, tax compliance status and a bank confirmation letter available on request. Buy through a proposal and SLA, a purchase order or a tender response. See company facts.
- Continuity and confidentiality. You own the evidence, reports and every credential we reset, and we hand over the record and playbooks at the end. Everyone with access to your systems is bound by confidentiality, and every remote session is approved and logged.