If anyone is in danger right now, call 911 first.
Something has happened. Here is who answers.
[confirm phone]
When something has gone wrong at your company, The Virtual C-Suite puts three people on one call within hours: a chief security officer who commanded the FBI's response to a mass-casualty attack, a business litigator who knows what you must and must not say, and a CIO who can find out what actually happened to your systems. Clients on retainer do not pay an emergency rate. Companies that are not clients can engage us for the incident.
What we respond to
- A data breach or ransomware event: what happened, what was taken, who must be notified and by when, how to work with the insurer and the forensics firm, what to tell customers and staff
- A credible threat or a workplace violence event: the immediate safety decisions, coordination with law enforcement, the threat assessment, what to say to employees, and the plan for the days after
- Employee theft, fraud or sabotage: preserving evidence, the investigation, the employment and legal steps in the right order
- A lawsuit, a subpoena or a regulator's letter: the litigation hold, what to preserve, who talks to whom
What happens in the first 24 hours
What we do not do
We do not provide guards, armed response or crisis counseling; we bring in and coordinate the firms that do. We do not replace your insurer's panel forensics firm; we manage them on your behalf. We do not handle the litigation itself under the retainer; David handles it, or refers it, under a separate engagement.
Why clients on retainer are in a different position
They have a plan we wrote together, a contact list that is current, an insurance policy we have read, and a team that already knows their systems and their people. The first hour is spent acting, not learning. Most of what we do on an incident for a non-client is work that a retainer would have done a year earlier.
Notification deadlines
Breach notification law in Maryland and most other states sets a deadline counted in days from when the breach is discovered, and some contracts and regulators set shorter ones. David will tell you yours on the first call. Do not wait for certainty about what was taken before you call; the clock may already be running.
The three seats
Questions owners ask
We are not a client. Can we still call?
Yes. Incident engagements for non-clients are priced per incident, quoted on the first call.
Should we pay the ransom?
That is a decision with legal, insurance and practical dimensions, and it is one we help you make with the insurer and the forensics firm, not one we answer on a web page.
Who do we call first, you or the police?
For any active danger, 911. For a crime that has already happened, usually us first, so that evidence is preserved and the report is made properly. Daniel spent 25 years on the other side of that call.
What does this cost?
Retainer clients are covered under their retainer up to their hours band, then at the band rate. Non-clients are quoted per incident.