Separate scope
FunctionOne scopes incident response separately from the monitoring service. It covers events that need more than monitoring and containment.
FunctionOne incident response
Detect, contain, escalate, review: incident response by FunctionOne
A company needs FunctionOne incident response when a cyber event needs more than monitoring and containment. We scope the service separately from monitoring. Our team detects the event, contains it within the authority you've approved, escalates with findings and evidence, and then reviews what happened. Your leadership makes the business and risk decisions and directs outside communications. We work from Syracuse, New York and Tampa, Florida.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What does FunctionOne incident response include?
FunctionOne incident response follows a set order of steps, and the findings shape changes to your systems and procedures.
Event detection
FunctionOne security analysts detect the event and confirm the findings.
Containment within approved authority
FunctionOne contains the event only within the response rules your organization approved. You agree on those rules before anything is switched on.
Escalation with evidence
FunctionOne escalates the incident to your leadership with findings and evidence. Your leaders get facts to weigh before they decide.
Leadership decision authority
Your leadership makes the business and risk decisions during an incident. FunctionOne gives those leaders what the team found.
Outside communications
Your leadership directs outside communications about the incident. FunctionOne supplies the findings those messages draw on.
Post-incident review
FunctionOne reviews the incident afterward. Findings inform changes to access, configuration, monitoring or procedures.
Why does FunctionOne keep leadership in charge of incident response?
NIST's Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), 2025, says leadership oversees incident response, allocates funding, and may have decision authority for high-impact actions such as shutting down or rebuilding critical services. We contain an incident only within the authority you've approved and bring findings and evidence to those leaders.
In its Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), 2025, NIST sorts incident communication into four kinds: coordination among the parties with roles, notification of affected customers, employees, partners or regulators, public communication such as media questions, and sharing threat information. Your leadership directs the outside communications. FunctionOne's findings and evidence give those messages a factual base.
CISA's Cross-Sector Cybersecurity Performance Goals 2.0, released in 2025, says incident response plans should be reviewed and drilled at least once a year. After an incident, our review findings inform changes to access, configuration, monitoring or procedures.
How does FunctionOne handle a cyber incident?
FunctionOne works through these steps when a cyber incident needs more than monitoring and containment.
Detect the event
Our security analysts watch connected systems 24/7 and confirm findings before they act.
Contain within authority
We contain the threat only within the response rules your company approved.
Escalate with evidence
We give your leaders our findings and the evidence behind them. Your leadership makes the business and risk decisions and directs outside communications.
Review and improve
After the event, we review what happened. Findings inform changes to access, configuration, monitoring or procedures.
When does a company need FunctionOne incident response?
Compare FunctionOne monitoring with incident response to decide what a serious event needs.
| Monitoring and containment | Incident response |
|---|---|
| Security analysts watch connected systems 24/7 | Incident response steps in when an event needs more than monitoring and containment |
| Analysts contain threats within response rules you approve | Containment stays within approved authority, then findings and evidence go to leadership |
| Leadership gets a monthly summary and a regular security review | Leadership gets findings and evidence at escalation, then a review |
| Leadership approves response rules before anything is switched on | Leadership makes business and risk decisions and directs outside communications |
| Monitoring runs as its own service | FunctionOne scopes incident response separately from the monitoring service |
Who is FunctionOne incident response for?
FunctionOne incident response is for established mid-size and large organizations that have outgrown a help desk.
Owners and executives
You report to a board, insurer, auditor or parent company.
IT directors
We work co-managed beside your in-house IT team, or we run IT fully managed. Containment follows your approved response rules either way.
Multi-office organizations
Your staff work across several offices. We run offices, laptops, phones, servers and cloud from one control point.
High-stakes operations
Your operations carry high stakes, so a serious event needs clear steps and leadership decisions. We serve clients from Syracuse, New York and Tampa, Florida.
FunctionOne incident response questions
What's the difference between monitoring and incident response?
FunctionOne monitoring means security analysts watch connected systems 24/7 and contain threats within your approved response rules. Incident response covers events that need more than monitoring and containment. FunctionOne scopes incident response separately from the monitoring service.
Who makes decisions during a cyber incident?
Your leadership makes the business and risk decisions, and FunctionOne brings the findings and evidence. NIST's 2025 report, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), says leadership oversees incident response, funds it, and may decide high-impact actions such as shutting down critical services.
Who handles communication with customers, regulators and the media after a breach?
Your leadership directs outside communications, and FunctionOne brings your leaders the findings and evidence. NIST's Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), 2025, sorts incident communication into coordination, notification of affected people or regulators, public communication, and threat information sharing.
Should we report a ransomware attack or pay the ransom?
The 2023 #StopRansomware Guide from CISA, FBI, NSA and MS-ISAC says to report the incident to CISA and the local FBI field office, and its authors do not recommend paying ransom.
How often should we test our incident response plan?
At least once a year, according to CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (2025), which say incident response plans should be reviewed and drilled. After an incident, FunctionOne reviews what happened, and findings inform changes to access, configuration, monitoring or procedures.
How do we get started with FunctionOne incident response?
You start with a security assessment, the first step for all FunctionOne clients. We review your systems and accounts, then agree on scope and response rules with you before anything is switched on. Incident response is scoped separately from monitoring.