“Please send a copy of your incident response plan.” Your cyber insurer asks at renewal. An enterprise customer asks in a security questionnaire. An auditor asks in a document request. Different senders, same email, and the honest answer in a lot of businesses is a template somebody downloaded two jobs ago with nobody’s name in it. This assessment exists so you can reply the same day with a plan that is recognizably about your organization.
What lands in your inbox
- Readiness assessment, every element accounted for. All 43 subcategories of a NIST CSF 2.0 catalog scoped to the NIST SP 800-61r3 incident response lifecycle. Each one is either an identified gap or explicitly not asserted ready. No invented scores, no percentages, and nothing quietly counted as passing.
- Your incident response plan. Roles with write-in name slots, a SEV-1 to SEV-4 severity matrix, bright-line activation criteria, a communication order, and evidence rules your team can follow at 2am.
- Scenario playbooks matched to your stack. Ransomware, business email compromise, data breach, insider misuse, lost device, vendor breach, AI-enabled fraud, and machine-speed intrusion. Steps differ by whether you run Microsoft 365 or Google Workspace, whether you have EDR, and the backup posture you actually reported. A ninth playbook covers incidents in your own AI systems when your intake reports generative AI in use.
- Regulatory notification matrix. Only the obligations your answers establish: HIPAA, SEC Form 8-K Item 1.05, FTC Safeguards Rule, NYDFS Part 500, state breach statutes, card brands, and your cyber carrier. Each row carries its deadline and its citation.
- Tabletop exercise kits and a 30/60/90 roadmap. Facilitated scenarios with timed injects, and remediation ordered by risk.
Priced to your organization
Every tier includes the full core deliverable. Larger tiers add the work a bigger organization actually needs, rather than a bigger number for the same document.
- Starter · $1,495 · 1 to 25 people. The complete assessment, plan, playbooks, notification matrix, one tabletop kit, and roadmap.
- Essential · $4,950 · 26 to 100 people. The same content contract, priced to an organization of this size.
- Professional · $12,500 · 101 to 500 people. Adds a second tabletop exercise, a board-ready summary, role assignments broken out by site, and a quarterly review cadence.
- Enterprise · $24,500 · 501 to 2,500 people. Adds four tabletop exercises, role assignments by legal entity with declaring authority named per entity, notification obligations mapped entity by entity, and a twelve-month exercise calendar.
- Multi-Entity · $34,500 · 2,500+ people across multiple legal entities. Adds a consolidated cross-entity rollup: which clock starts first across the group, who owns it, and which shared systems reach every entity.
How it runs
- Minute 0. Checkout, then a welcome email with your intake link.
- Minutes 3–5. Seventeen plain questions about how your business actually runs. No uploads, nothing to install, no scan to schedule.
- Hours 1–8. Aegis AI builds the deliverable and emails the PDF. No call. Two business days at the outside.
Why it is worth what it costs
Organizations with a documented incident response plan average about $2.66 million less in breach cost. Teams that actually exercise the plan averaged $3.29 million per breach against $5.29 million for teams with neither a plan nor tests. Emergency incident response without a retainer runs $800 to $1,500 an hour.
What this is not
- Not automated incident response. This is preparedness on paper: the plan, the playbooks, and the deadlines, before anything happens. The capability that detects and contains an incident at machine speed is AIR AI™, a separate deployed capability for defense and government programs.
- Not a monitoring or forensic service. Nothing is installed and nothing watches your network.
- Not legal advice and not a certification. Counsel confirms notification obligations during a real incident. The matrix tells you which clocks exist and where they come from.
Get yours
OFAC and Authorized Signatory certification required at intake. Service is for organizations not subject to U.S. sanctions and signed by an officer authorized to bind the company.
Tell us your organization size and we will send the tier that fits and its checkout link. One reply, no sales sequence.
Need more than incident response? See the Multi-Framework Snapshot →