Incident response for Australian organisations.
Containment and triage, root-cause remediation, and support with the Notifiable Data Breaches assessment under the Privacy Act 1988.
24/7 incident line:1800 370 270
Triage establishes the entry point, the scope and the data touched. The compromise is traced to the code, configuration or infrastructure behind it, the fix is engineered and shipped, and the remediated surface is re-tested.
If you suspect a breach now
If you suspect a breach now, the first-hour steps do not depend on us: isolate affected machines without wiping them, preserve logs, contain accounts from a known-clean device, engage your insurer, and note your notification clock.
Stages of an engagement
Call the 24/7 incident line on 1800 370 270 or email info@blackshard.com.au. A suspected incident is sufficient to begin triage; a confirmed breach is not required.
- Contact and triage: entry point, scope, and data touched, established from what you can tell us
- Containment: actions agreed with you before they are taken, without destroying what root-cause analysis will need
- Root-cause analysis: the compromise traced to the code, configuration or infrastructure behind it, and the adjacent gaps
- Remediation and re-test: the fix engineered and shipped, then the remediated surface re-tested
- Close-out: an incident record for your board, insurer or legal advisers, and Notifiable Data Breaches support
Notifiable Data Breaches support
Where personal information is likely involved, the Privacy Act 1988's Notifiable Data Breaches scheme requires a prompt assessment of whether the breach is likely to result in serious harm, and notification if it is. Black Shard supports that assessment.
Legal advice and the incident record
We do not give legal advice; the legal decision sits with your legal advisers.
The support consists of a factual incident record drawn from the containment and root-cause work, and the changes that make the same assessment faster if it is needed again.
Incident readiness
Incident readiness is available before an incident: a response plan written for your team and systems, a tabletop exercise that runs the plan against a scenario, and backup and recovery verification by performing a restore.
It is part of a vCISO engagement and is available on its own.
What does incident response cost?
There is no published figure. Incident work is scoped to what happened: the systems affected, how far the compromise reached, and whether the engagement stops at containment or extends through root-cause remediation and re-testing.
Mid-incident
If you are mid-incident, email info@blackshard.com.au before scoping it precisely. Containment starts and the detail is filled in as the picture clears.
Questions, answered
How fast can you start?
Email info@blackshard.com.au. Triage begins on what you can tell us, and containment does not wait for a fully scoped engagement.
Do you give legal advice on our notification obligations?
No. We support the Notifiable Data Breaches assessment with a factual incident record and technical analysis. The legal decision sits with your legal advisers.
Do you fix the underlying flaw as well as containing the incident?
Yes, where that is what you want. Containment stops the immediate damage. Root-cause analysis and remediation fix the code, configuration or infrastructure that allowed it, and the remediated surface is re-tested.
Do you work with organisations outside Brisbane?
Yes. Scoping, containment coordination and the debrief run by phone, video and secure access wherever in Australia you operate. Brisbane organisations have the option of on-site containment and an in-person debrief, described on the incident response, Brisbane page.
Can you help us get ready before an incident happens?
Yes. Incident readiness produces the response plan, runs a tabletop exercise against a scenario, and verifies backups by performing a restore.
Related reading
The full practice: Breach remediation & incident response.