Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyIncident Response & Forensics
Contain. Investigate. Prepare.
In a cyberattack, every decision counts. Our incident response services help you contain the incident, preserve evidence, investigate the attack and restore operations in an orderly way – remotely and on-site. We also help you prepare so that a security incident doesn’t turn into a crisis in the first place.
Overview
Incident response (IR) is the structured response to an IT security incident: detecting the attack, limiting the damage, locking out the attackers, cleaning up systems and safely restoring operations. Closely related is digital forensics, which preserves digital evidence using recognized methods and reconstructs what actually happened. Together, the two are known as DFIR – digital forensics and incident response. In short: incident response stops the attack, forensics explains it.
Why the first hours matter: In an IT emergency, far-reaching decisions have to be made early. Which systems need to be taken offline without losing evidence? Do the attackers still have access? At the same time, the clock is ticking: under Art. 33 GDPR, reportable personal data breaches must be notified without undue delay and, where feasible, within 72 hours; for significant incidents under NIS2, an early warning is due no later than 24 hours after becoming aware of the incident. Having experienced help at hand quickly during a cyberattack limits the damage and the follow-on costs.
Why preparation makes the difference: An emergency plan with clear roles, rehearsed procedures and logging that provides the evidence you need when it counts shortens every response. That’s why our practice covers both: acute help and preparation – guided by modules DER.2.1 to DER.2.3 of IT-Grundschutz, the baseline security framework of the BSI (Germany’s Federal Office for Information Security), and by BSI Standard 200-4 as well as ISO/IEC 27035 and NIST SP 800-61 Rev. 3.
Attacker know-how from offensive security: As an incident response services provider, we also know the other side – from Penetration Testing and Red Teaming & APT Simulation, where we apply attacker techniques ourselves, under controlled conditions and on our clients’ behalf. That’s why we know where attackers leave traces and how they dig in.
Our Services
Choose the service that fits your situation. We prepare an individual quote for every service in this area.
Immediate help after a cyberattack – contain, investigate and restore, remotely & on-site.
Help with encryption and extortion – contain, investigate and restore cleanly.
Secure digital evidence, reconstruct attacks and investigate insider cases.
Analyze malware safely, extract IoCs and provide detection rules.
Check if attackers are or were active undetected in your network, identities or cloud.
Response plan & playbooks – roles and reporting lines so everyone knows what to do.
Rehearse realistic crisis scenarios with management and IT – without risk to operations.
Prepare logging and evidence handling so forensics can succeed when it counts.
Why Rootsektor
Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST), you can reach us at +49 2932 465265-0; outside business hours, the same number is our 24/7 emergency hotline. We help remotely and on-site – in Germany and internationally.
As penetration testers, we use attack techniques ourselves – and know where to find traces and the backdoors attackers leave behind.
We’re independent of vendors and service providers, including your IT service provider. We secure evidence with hash values and an unbroken chain of custody, and we clearly separate facts from assessments.
We provide the technical facts for reports to the data protection supervisory authority, the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance) or BaFin (Germany’s Federal Financial Supervisory Authority), keep an eye on the deadlines together with you and, if you wish, coordinate with your cyber insurer.
Process
Every incident is different, but the basic structure stays the same: we follow the recognized phases of incident handling. A dedicated contact person at Rootsektor coordinates the work and keeps your decision-makers up to date.
Emergency plan, reporting lines, playbooks, meaningful logs and rehearsed procedures – the better the preparation, the faster the containment.
We assess the first indicators, narrow down the affected systems, accounts and data, and capture volatile evidence from memory. This creates an initial picture of the situation – including whether reporting obligations apply.
We isolate affected systems, lock compromised accounts and cut off the attackers’ access – coordinated with your IT team so that as much as possible keeps running and no evidence is lost.
We identify the entry point, malware and backdoors and support the cleanup – for example, the coordinated reset of credentials in Active Directory or the rebuild of compromised systems.
Systems and data are restored from verified, clean backups and brought back into operation step by step – under heightened monitoring, so that any return of the attackers is spotted early.
A final report documents the cause, course of events and measures taken. In a lessons-learned session, we derive improvements for technology, processes and the emergency plan.
Areas of Focus
Three situations, three focus areas – depending on whether an attack is underway, needs to be investigated or you want to be prepared.
Respond
An attack is underway or has just been discovered. Now it’s about limiting the damage and making the right decisions under time pressure.
Investigate
You need reliable facts – about what happened, which data is affected and whether the attackers are still in the network.
Prepare
When it counts, everyone should know what to do – and the necessary evidence should be available.
Incident Report
After an incident, you have to justify your decisions – to senior management, authorities and insurers, and sometimes in court. Our report documents what happened, how it came about and what needs to be done now – backed by sources and timestamps and traceable for third parties.
Call us right away: +49 2932 465265-0 – outside business hours (Mon–Fri, 8:00 a.m.–5:00 p.m. CET/CEST), the same number is our 24/7 emergency hotline. Alternatively, report the incident via our emergency form or by email to incident@rootsektor.de – we’ll call you back.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Disconnect affected systems from the network, but don’t shut them down – otherwise volatile evidence in memory will be lost. Don’t delete or reinstall anything, and write down your observations with the time. Then call us or use the form at Report an emergency. You’ll find more immediate steps under IT Emergency Response.
Often, several obligations apply in parallel. Under Art. 33 GDPR, personal data breaches must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours – unless the breach is unlikely to result in a risk to the individuals concerned; if the risk is high, those individuals must also be notified under Art. 34 GDPR. Entities covered by NIS2 – including operators of critical facilities – report significant incidents in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after that notification; in Germany, under § 32 BSIG (German BSI Act), these reports go to the joint reporting office of the BSI and the BBK. Financial entities report major ICT-related incidents under DORA to their supervisory authority, usually BaFin. We provide the technical facts; you make the legal assessment together with your legal counsel.
Yes. If you wish, we coordinate with your cyber insurer and provide the facts for claims handling – such as the cause, scope and measures taken. Many policies require prompt notification of a claim and contain requirements for involving external service providers. So inform your insurer early and check your obligations under the policy.
No. We don’t offer standby or retainer contracts – you can contact us directly in an emergency, even if you’re not yet working with us. We offer the services in this area individually and agree on the scope and terms with you right at the start.
That depends mainly on your backups. If offline or immutable backups exist and are intact, the chances are good; for some ransomware variants, free decryption tools are also available, for example through the No More Ransom initiative. No reputable provider can promise a complete recovery. We don’t conduct ransom negotiations – the BSI and the police generally advise against paying ransoms. Learn more under Ransomware Response.
In many cases, filing a criminal complaint makes sense. For businesses, the first points of contact are the Central Contact Points for Cybercrime (ZAC) run by Germany’s federal and state police forces. Whether you file a complaint is your decision – ideally made together with your legal counsel. We prepare our documentation so that you can hand it over to the investigators.
Want to build an emergency plan, run a tabletop exercise or find out whether attackers are already in your network? Write to us – you’ll receive an individual quote. In an acute incident, please call us directly: +49 2932 465265-0 – or use the form at Report an emergency.
Diese Seite gibt es auch auf Deutsch.