How an organisation handles the first hours of a cyber incident often determines how bad it becomes. Incident response readiness means having a plan people know, playbooks that match your environment, evidence available when you need it, and decisions such as regulator notification rehearsed in advance. WC1 helps Singapore and Philippine organisations prepare, and helps coordinate with specialist forensic and legal firms when an incident occurs.
The problem: why incident response readiness matters
Many incident response plans are generic documents that nobody has read since they were approved. When ransomware hits, teams discover that backups are reachable by attackers, logs were not retained, contact lists are outdated, and nobody knows who decides whether to notify regulators.
Regulatory clocks start early: one hour for relevant incidents reported to MAS, three calendar days for PDPC notification after a breach is assessed as notifiable, and 72 hours for NPC notification in the Philippines. Without rehearsal, those deadlines are missed.
Who this service is for
Executives, boards, IT and security teams, and legal and communications functions at organisations of any size, particularly regulated entities, CII owners, and organisations that have never run a realistic exercise.
What WC1 delivers
Every engagement is scoped to your environment and risk. These are the building blocks we combine for incident response readiness:
- IR plan and governance: A concise, role-based incident response plan with severity levels, decision rights, and communication paths.
- Scenario playbooks: Playbooks for ransomware, business email compromise, data breach, insider threat, cloud account compromise, and DDoS.
- Tabletop exercises: Realistic exercises for executive teams and technical teams, with injects tailored to your business and regulators.
- Ransomware readiness: Review of backup isolation, recovery testing, identity hardening, and containment capabilities.
- Forensic and log readiness: Logging, retention, and evidence handling so investigations are possible when needed.
- Notification and communications workflow: Decision trees and templates for regulator, customer, and media communication under Singapore and Philippine requirements.
How the engagement runs
1. Review
Assess current plans, tooling, backups, logging, and contracts with external responders and insurers.
2. Build
Write or refresh the plan and priority playbooks, and align them with insurance and legal counsel.
3. Exercise
Run executive and technical tabletops, and capture lessons learned.
4. Improve
Close gaps in backups, logging, access, and contacts, and update documents.
5. Repeat
Schedule annual exercises and plan updates after significant changes or incidents.
Commercial shape follows the work: a fixed-scope assessment or implementation when the problem is well bounded, or a retainer when you need ongoing operation, tuning, and reporting. Coverage hours, response times, and responsibilities are written into the statement of work so there are no surprises.
Deliverables you can expect
- Incident response plan with RACI
- Scenario playbooks for priority threats
- Tabletop exercise pack and after-action report
- Ransomware readiness assessment
- Log and forensic readiness checklist
- Regulator notification decision tree and templates
Platforms and tools we integrate
Readiness work integrates with the tools you already run, such as Microsoft Defender XDR and Sentinel, CrowdStrike Falcon, Palo Alto Networks Cortex XDR and XSOAR, Fortinet FortiSOAR, and backup platforms such as Veeam, Rubrik, and Cohesity. For major incidents, we coordinate with specialist incident response firms, such as those retained by your insurer or platform vendor, including Unit 42 and CrowdStrike Services. Cisco environments are covered too, including Cisco Talos Incident Response.
WC1 is vendor-neutral: we integrate the platforms you already own before recommending anything new. Naming a product here describes technology we work with; it does not imply a partnership, reseller agreement, or vendor certification.
Singapore: regulatory and market relevance
MAS requires relevant incidents to be reported within one hour of discovery and expects financial institutions to have tested incident response and recovery plans under the TRM Guidelines. The PDPA requires notification to the PDPC within three calendar days after determining a breach is notifiable. CII owners must report prescribed incidents to CSA within two hours under the Cybersecurity Act, whose 2024 amendments came into force in October 2025. Tabletop exercises rehearse each of these decisions.
Philippines: regulatory and market relevance
The NPC requires notification of qualifying personal data breaches within 72 hours of knowledge, under NPC Circular 16-03 and subsequent rules. BSP requires banks to report major cyber incidents and expects tested incident response plans under Circular 982. Government agencies coordinate with DICT and CERT-PH. Rehearsed workflows help Philippine organisations meet these deadlines.
How this fits the rest of your security programme
Incident Response Readiness rarely stands alone. It works best alongside Managed Detection and Response, XDR and Endpoint Security, Cybersecurity Compliance and Advisory, SIEM and SOC Modernization. See the full catalogue on our Cybersecurity services page.
Related reading: Board cyber questions after the first breach drill; Disaster recovery tabletop script for hybrid cloud.
Frequently asked questions
Do you provide emergency incident response?
We help coordinate and support incident handling for clients, and for complex forensic investigations we work alongside specialist incident response firms, often those appointed by your insurer. We are clear about roles so you get the right expertise quickly.
How long does a tabletop exercise take?
Executive tabletops typically run two to three hours; technical exercises can take half a day. Preparation involves tailoring scenarios to your business.
Should we pay a ransom?
That is a business and legal decision that depends on many factors, including legal restrictions. Your plan should define who decides and what advice they need, which we help establish in advance.
How often should we exercise?
At least annually, and after major organisational or technology changes. Many organisations run a technical exercise and an executive exercise each year.
Does this help with cyber insurance?
Yes. Insurers increasingly ask about incident response plans, tested backups, and exercises, and readiness work often improves both insurability and claims handling.
Next step
Tell us when you last exercised your incident response plan. We will propose a readiness review and a tailored tabletop scenario. Contact WC1 for a no-obligation conversation; we will tell you honestly if we are not the right fit.