Incident response when something is already happening.
F Creative Studio 360 contains, preserves and explains a cyber incident for organisations in any country. Counsel decides what is filed.
The first job is to stop it spreading.
The shape of the work follows NIST SP 800-61: prepare, detect, contain, eradicate, recover, and learn. F Creative Studio 360 joins at the point the incident is known.
A notice to a regulator, customers or law enforcement is the organisation’s decision. Examples of regimes that can apply, only when the organisation is subject to them, include GDPR, the Notifiable Data Breaches scheme and CPS 234.
- An incident is already underway
- This service starts when something has happened. Planning, a retainer and a tabletop are how you prepare. They are different engagements.
- Authority comes first
- F Creative Studio 360 confirms who can authorise containment before systems are changed. A response time, if one is offered, is in that engagement, not printed here as a universal promise.
- Evidence is kept
- Containment and preservation happen together. A later forensic investigation is scoped separately when the organisation needs a defensible record.
- Counsel owns the filing
- The work names who may need to be told. Your counsel decides whether a regulator, customers or law enforcement are notified, and files what the law requires.
What the response covers
The same method works in any country. What changes is who must be told, and that decision stays with counsel.
- Triage
- Is this an incident, and how far has it reached? The first note is for the people who can decide.
- Containment
- Limit what is still happening, using the actions the organisation has authorised. No availability test, and no change beyond that authority.
- Eradication and recovery
- Remove what does not belong, and restore the service the business named as critical. The organisation owns the restore decision.
- A timeline
- What is known about how the event started and what it touched, written so counsel and management can use it.
- Communication support
- A factual brief for executives. Public statements and regulatory notices stay with the organisation and its counsel.
- What to fix next
- A short list after the event. It is not a certification that the environment is safe.
How a response runs
It can be remote or on site. Systems are changed only with authority from the organisation.
- 1
Make contact
Email hello@fcreativestudio360.com or use the contact page, and say an incident is underway. F Creative Studio 360 confirms who has authority to act.
- 2
Stabilise
Contain what is still active, and preserve what a later investigation will need.
- 3
Explain
A timeline and an impact note for the leadership team. Attribution is stated only where the evidence supports it.
- 4
Hand back
Recovery steps the organisation will run, and the questions counsel still has to answer.
Common questions
When do we use this service?+
When an incident is happening or has just happened. A retainer is how you arrange priority access beforehand. Planning is how you write the playbook. Forensics is the defensible investigation. They can follow one another, and they are not the same engagement.
Where do you respond?+
For organisations in any country, remotely or on site. The first step is authority to act, not a promise that someone is in the building within a fixed number of minutes.
Do you notify regulators for us?+
No. The work records what happened and when the organisation became aware. Whether a notice is required, and who files it, stays with your counsel. F Creative Studio 360 does not file reports for you.
Will you decrypt ransomware?+
No. The work contains the incident, preserves evidence and advises on recovery from backups the organisation already has. Decryption is not offered, and paying an attacker is the organisation’s decision with its counsel.
How much does it cost?+
An active incident is scoped to what is known at the start, and the scope can change as the facts change. A retainer, agreed in advance, is the way to fix commercial terms before an event. There is no obligation to proceed.
If an incident is underway, write to the team.
Say what you have seen and who can authorise action. F Creative Studio 360 will say what it can take on.