Full Ransomware Recovery During a Blizzard
A 100-bed critical access hospital was hit by ransomware that infected 140 workstations. The recovery team still restored every system, with no data loss, as described in the case study.
Read the case studyCybersecurity
Incident Response Services
A written plan and a defined escalation path, so nobody improvises during a breach.
Our incident response services give you a written plan and defined escalation steps before anything goes wrong, so your team is not improvising during ransomware or a suspected breach. When an incident happens, we help contain it, document what happened, and support the notifications your industry may require. Incident response is included with our higher service packages, and forensic investigation runs through our forensics partner. It is built for regulated organizations with real notification deadlines.
What incident response includes
Planning happens before the incident. Response follows the plan.
Written incident response plan
Goals, internal processes, roles, decision-making authority, communications, and documentation steps, written down and kept current.
Containment and documentation
Help containing the incident, preserving evidence, and recording what happened and what was done. Included with our higher service packages.
Forensics through our partner
Forensic investigation and full-scale incident response are delivered through our forensics partner. You contract with the partner directly, at added cost, and NorthStar coordinates the work in your environment.
Notification deadlines we help you plan for
Your industry decides who must be told and how fast. Your plan should name these before you need them.
HIPAA
Breaches of unsecured protected health information require notice to individuals no later than 60 days after discovery, plus HHS and sometimes the media.
FTC Safeguards Rule
Notification events involving 500 or more consumers must be reported to the FTC no later than 30 days after discovery.
DoD contractors
DFARS 252.204-7012 requires cyber incidents to be reported to DoD within 72 hours of discovery, with affected images preserved for at least 90 days.
Cyber insurance
Many policies set their own notice window and require insurer-approved vendors, so your plan should follow your policy.
Who this is for
Incident response is built for regulated organizations where the clock starts the moment an incident is discovered.
Case studies
These published case studies describe real response and recovery work after an incident.
Related services and resources
Regulatory references
Primary sources for the notification deadlines mentioned on this page.
Frequently Asked Questions
Your organization remains responsible for its own compliance program. We help you implement and document the technical and administrative work that program depends on. Nothing on this page is legal advice or a certification.
About the author
Ken Satkunam, CISM
President & Founder, NorthStar Technology Group
Ken has spent over 25 years in IT leadership, serving in roles from technical support to CIO for organizations as large as 23,000 employees. He founded NorthStar Technology Group in 2000 to help regulated organizations build secure, compliant, and operationally resilient technology environments. Ken holds the Certified Information Security Manager (CISM) credential from ISACA and is the co-author of the Amazon best-seller "Cyber Attack Prevention." He has been quoted in industry publications including eWeek and DM News, and NorthStar has been recognized on the Inc. 5000 list in both 2024 and 2025.
CISMInc. 5000MSP 500Published Author25+ Years
Put a plan in place before you need it
Tell us about your current plan, or the lack of one, and the regulations you work under. We can talk through incident response coverage that fits.