Under attack right now? Do this first
- Disconnect, don’t wipe. Unplug affected computers from the network or turn off their Wi-Fi, but leave them powered on. Wiping or rebuilding now destroys the evidence your insurer and investigators need.
- Call your cyber insurance carrier if you have a policy. Many require you to report the incident first and use their approved breach coach and forensics firm.
- Don’t pay or contact the attackers until you’ve spoken with your insurer and legal counsel.
- Change passwords from a clean device, starting with email and administrator accounts, and turn on multifactor authentication.
- Call us at 866.24.CALIT.
How we respond
- 01 · Contain
Stop the spread
Isolate infected devices, disable compromised accounts, revoke sign-in sessions and block the attacker’s way back in.
SentinelOne isolation - 02 · Investigate
Find the way in
Work out how the attacker got in and what they touched, alongside your insurer’s forensics team and breach counsel when a claim is open.
Logs · SIEM - 03 · Recover
Restore from clean backups
Rebuild affected systems, check backups are clean before restoring, and clean up Microsoft 365 mailboxes, rules and app permissions.
Tested restores - 04 · Harden
Close the gaps
MFA everywhere, EDR on every device, email security, patching and locked-down administrator accounts — the controls that would have stopped it.
MFA · EDR - 05 · Prevent
Stay protected
Managed Care keeps it that way: a 24×7 SOC watching every device, backups tested on a schedule and training for your team.
24×7 SOC - 06 · Coordinate
Work with your insurer
We coordinate with your cyber insurer and its forensics team, and document what happened and what we changed.
Insurer coordination
Switching to CAL IT Group after an incident
We deliberately take on project work only for our Managed Care clients, so our engineers already know every client environment before anything goes wrong. After an incident we can onboard a new business immediately — we’ve done it before with no overlap from the outgoing provider — so you aren’t paying one company to clean up while waiting weeks to start with another. Read how switching IT providers works.
After an incident, stopping the next one matters as much as the cleanup. We lock down what’s allowed to run on your computers, require multifactor sign-in everywhere and watch every device around the clock, so ransomware and unknown tools are blocked before they start.
Be ready before it happens
Backups you’ve actually restored
Ransomware goes after backups first. Ours are copied off-site, checked every day and test-restored. See backup and disaster recovery.
A plan with names and numbers
Your vCISO writes a one-page incident response plan and walks your leadership through it once a year.
Know where you’re exposed
Take the free cyber risk self-check or the cyber insurance readiness check, and see what an hour offline costs with the downtime cost calculator.
Financial protection
A cyber warranty adds financial protection if an attack gets through.