Search HAI Consulting
Find consulting services, industry guidance, work examples and practical resources across the site.
Search results
28 results found. Search results for “incident response”.
Consulting
Testing ransomware readiness before an incident
A representative ransomware tabletop that tests authority, communications, identity recovery and restoration decisions before an incident.
IndustryCybersecurity and infrastructure for professional services
Protect client information, support hybrid work, and reduce technology risk without slowing down your billable teams.
IndustryCybersecurity and network consulting for financial services
Assess access, network controls, third-party exposure, and recovery plans around systems that handle financial data and transactions.
IndustryCybersecurity and resilient infrastructure for healthcare
Strengthen access, networks, and recovery around sensitive health information and systems that staff need to deliver care.
ServiceFirewall policy review
Review firewall policy intent, effective access, ownership and observed use before making bounded cleanup or risk-reduction changes.
ServiceManaged IT services
Hands-on IT operations during Canadian business hours: patching, backup checks, account and device administration, and current documentation.
ServiceMicrosoft 365 security and administration
Microsoft 365 security and administration for Canadian organizations: Entra ID, conditional access, mail security, sharing, Intune and licensing.
IndustryPractical cybersecurity for nonprofits
Protect donor, staff, and program information with security work shaped around limited budgets, lean teams, and changing access needs.
ServiceResilience and recovery
Test whether critical services can be restored, identify fragile dependencies and leave recovery evidence that operators can use during an outage.
ServiceRetained IT and security management
Ongoing scheduled review, maintenance planning and advisory support under a retainer, so security and infrastructure work continues after a project ends.
ServiceCloudflare security and edge services
Review and improve Cloudflare DNS, TLS, WAF, access and edge configuration with controlled rollout, evidence and a practical rollback path.
IndustryCybersecurity and connectivity for construction firms
Secure offices, job sites, mobile teams, and project partners while keeping plans, communications, and business systems available.
ServiceCybersecurity assessments
Assess current security controls, evidence and ownership, then turn verified findings into a prioritized and operationally realistic improvement plan.
Resource library
Incident-readiness questionnaire
Find the practical gaps that can slow decisions, communications, containment, evidence handling, and recovery during a cyber incident.
ArticleSecurity logging coverage and retention: design for the investigation
Build a logging plan from investigation questions, evidence paths and response ownership instead of collecting high-volume data without a use case.
ArticleCybersecurity Assessment Scope: A Buyer’s Evidence Checklist
Define the decisions, service boundaries, evidence, testing depth and deliverables that turn a cybersecurity assessment into an actionable plan.
ArticlePatch management for small businesses: a routine that holds
Patching rarely fails for lack of tools. It fails when nobody owns it. A monthly update routine, an emergency lane and proof that the patches landed.
ResourcePrivileged access and emergency access review
A worksheet for reviewing privileged access: who holds it, why, when it was last confirmed, and what evidence supports keeping it.
ArticleRansomware Recovery Readiness: A Checklist You Can Prove
A practical checklist for proving ransomware recovery works: what to test, what evidence to keep, and which assumptions usually fail under pressure.
Resource librarySecurity and infrastructure resource library
Browse HAI Consulting field guides, learning paths, templates and diagnostic tools by topic, technology or format.
ResourceSecurity assessment scoping and evidence worksheet
Define what an assessment must answer, gather evidence consistently, and separate verified findings from assumptions.
Knowledge topicSecurity Operations
Operate privileged access, third-party connections and security evidence as owned lifecycles with tested recovery and shutdown paths.
ResourceSecurity logging coverage and retention worksheet
Map the events needed to investigate material incidents, verify collection and retention, and expose blind spots before an alert or outage.
ArticleBusiness email compromise: stopping payment fraud
Business email compromise turns a trusted email thread into a payment to the wrong account. The Microsoft 365 settings and payment checks that stop it.
ArticleDNS Migration With a Rollback Plan That Can Actually Work
A DNS provider migration runbook covering zone discovery, TTLs, DNSSEC, delegation, split authority, validation and the time-dependent realities of rollback.
KnowledgeKnowledge from the field
Cybersecurity, network, infrastructure, Cloudflare, Palo Alto, Cisco and practical AI guidance.
ArticleThird-party remote access: control the whole connection lifecycle
Turn vendor and support access into an owned lifecycle with named identities, narrow paths, visible sessions, expiry and a tested shutdown method.