Frequently Asked Questions

We support organizations that need specialist incident response support, clear root-cause findings, and stronger security operations.

We start with an initial consultation, align on objectives and expected outputs, then proceed under an SOW/contract.

Yes. TrustedOrb services are delivered fully remotely, using secure channels and controlled access.

Yes. NDA can be executed before any sensitive technical discussion.

A short incident or issue summary, affected systems, technical points of contact, and what telemetry/logging/security tools you have in place.

Yes. We can support on an ad-hoc basis, subject to availability and urgency. For high-severity incidents or recurring needs, a retainer typically provides priority access and a faster activation path.

Consultations are booked through the Microsoft Bookings calendar available on the website. Select the relevant service, date, and available time slot, and the confirmation is sent automatically by email.

Responsible vulnerability reports should be sent to [email protected], in line with the vulnerability reporting page. For active incidents, use the phone contact channel indicated on the website.

As soon as you suspect an incident or have credible indicators. Early action reduces impact.

For an active incident, use the phone number shown on the incident response page or contact page. Microsoft Bookings and the vulnerability reporting address are not emergency channels.

Initial triage, containment, technical investigation, support for eradication and recovery, and post-incident findings and recommendations.

We establish secure collaboration channels, points of contact, access procedures, and a cadence for updates so decisions are fast and documented.

Large-scale "clean-up" actions that destroy evidence, disabling logging, or major reconfiguration before the situation is understood.

A clear incident summary, incident timeline, root-cause findings (where possible), impact, actions taken, and prioritized remediation recommendations.

Defined objectives, review of controls/processes, evidence-based findings, and risk-prioritized recommendations.

Root Cause Analysis identifies underlying causes (not just symptoms) to drive durable fixes.

An executive summary, technical findings, and a prioritized improvement/remediation plan.

It depends on scope: from a few days (focused) to multiple weeks (broader review).

Yes, through targeted re-testing/review aligned to the agreed scope.

Typically tailored by role (executive, IT, security) and aligned to your operating reality.

Operational steps, escalation paths, checklists, and communication templates for repeatable response.

Yes. Tabletop exercises validate decision-making and coordination using structured scenarios.

A clear improvement list: what worked, what didn't, what to change in procedures and communications, and next steps.

Yes, fully remote.

A pre-agreed framework that enables faster activation and prioritized access during an incident.

A contractually agreed set of measurable commitments (e.g., response time), how they're measured, and what happens if they're not met.

Yes, response time/SLA is one of the most frequently highlighted buyer requirements in retainer guidance.

Through a predefined activation path: contacts, severity, initial information, and access steps.

Depending on the package, retainers often include proactive readiness work (playbooks, exercises, reviews) to reduce incident likelihood and impact.

Yes. We provide an indicative readiness assessment and help identify whether a formal country-specific applicability review is needed. We focus on practical gaps, evidence, and incident readiness.

No. It is an indicative screening tool. It helps structure the conversation before a formal regulatory assessment, performed separately based on the organization's context and available evidence.

The result is shown at the end of the questionnaire and can be sent by email to the person completing it. For follow-up and internal review, the result is also sent to the TrustedOrb team together with the submitted name, email, and organization.