Urgent
When things are on fire, we help you decide what to do
A supervisory letter from IMY, a leaked customer database or a ransomware attack rarely leaves any time to think. We step into the situation, work out what actually applies and what must be done within 24 and 72 hours – and what can wait.
Urgent Book a meeting or email us – we normally reply within one working day.
Is it urgent? Get in touch. We always start with a free 20-minute call where we go through the situation and tell you straight whether you need us, a lawyer or someone else entirely.
Four situations
This is what people call us about
All four have one thing in common: there is a clock ticking, and someone outside is waiting for an answer.
IMY has been in touch
A supervisory letter, a questionnaire or an order to provide information. What they are asking about, what you must answer and what you should not say.
Personal data has leaked
A misdirected email, a stolen computer, an exposed system or an intrusion. Should it be reported, to whom, and what should the report contain?
You have been hit by an IT attack
Ransomware, an intrusion or a hijacked account. The first few hours decide how much you lose – and whether you can prove what happened.
A customer or an authority demands answers
Are we covered by NIS2? How do we report the incident? What does management's personal liability mean? And what do we do first?
Are you in the middle of a tender or a customer audit instead? Then security requirements from customers is the right page.
How we work
From panic to priorities
-
1. The call – 20 minutes, free of charge
What has happened, when did it happen, what do you know and what do you not know? We listen to the end before we suggest anything. Often this call is enough for you to make the next decision yourselves.
-
2. Facts and deadlines
We map what is known, what is assumption and which deadlines apply. 24 hours, 72 hours or no rush at all – that determines everything else.
-
3. Prioritisation: three things, not twenty
What must be done first, what can wait until next week and what should we leave alone? We write it down so that you can make decisions even when we are not in the room.
-
4. The documents
The notification, the reply to the supervisory letter, the letter to customers, the incident report. Concrete texts that stand up to being read by an authority, a customer or an insurer.
-
5. Implementation
We support you in dealing with authorities, customers, suppliers and insurers – and carry out the technical measures needed to close whatever is still open.
-
6. Afterwards
When the acute phase is over, the same weaknesses are almost always still there: no procedure, no owner, no documentation. So we draw up an action plan so that you don't have to call again.
While you wait
Five things you can do yourselves today
- Appoint one person to hold it together. One person who collects questions, answers and times. Two people answering the same question from an authority give two different answers.
- Write down what you know – with times. When was it discovered, by whom, what was done then? The first day you remember is the hardest one to reconstruct afterwards.
- Don't touch logs and evidence. Leave systems, backups and email logs alone. Cleaning up traces is the most common mistake and the most costly one.
- Don't reply in a panic. A short confirmation that you have received the question, and that you will come back within the deadline, is always better than a quick and incorrect answer.
- Call your insurer early. Cyber and liability policies often have both notification deadlines and requirements on which consultants may be engaged.
What we are not: we are not lawyers. Where legal assessments are needed, we work together with your lawyer or legal counsel – we handle the technology, the facts and the documentation, they handle the legal assessment. We never promise a particular outcome with an authority, because nobody can.
Questions and answers
What we get asked
What does it cost to get in touch?
Nothing. The first call is 20 minutes, free of charge and with no obligation. We will tell you if we think you do not need us.
What do you need to know when I call?
What has happened, roughly when, who already knows about it and whether anyone outside is waiting for an answer. If it is unclear, that is an answer too – we start there.
Can you step in today?
Often, but not always. We tell you straight away if we cannot, and then help you find someone who can instead.
We have already made mistakes – can you still help us?
Yes. The most common case is not that someone has done everything right all the way, but that someone waited too long to act. Having discovered and remedied shortcomings counts in your favour.
Do you work outside Västra Götaland?
Yes, we work across the whole of Sweden and online. Urgent work is usually done remotely, with screen sharing and phone.
More urgent situations
Other situations we step into
Urgent
Better to get in touch once too often
We listen to the situation, tell you what we see and what we would do first. Then you decide whether you want us involved.
Urgent Book a meeting or email us – we normally reply within one working day.