StateNormal
00Observation
Normal
Prepare. Contain. Recover. Evolve.
A cyber crisis is an operational, legal and reputational event. Ordfall coordinates the technical and executive fronts so the decision stays under control.
Baseline
Nominal operation.
The system runs inside what was declared normal. The useful question here is not whether something will fail — it is whether the operation could say, with evidence, when it started to.
- 01Baseline declared and reviewed
- 02Event logging and retention defined
- 03Roles and decision authority written down
This page is the incident line itself. Each state is a band; the surface darkens down to containment and comes back to light at evolution. Scroll to advance.
Walk the line down
Event axis
Illustrative · no time scale
01Signal
Detect
Something behaves outside the pattern.
- Deviation recognised against the baseline
- First triage: scope, reach and timing
- Formal opening of the event record
Detection starts when a deviation is recognised as one. Without a baseline every event is noise; with a baseline an event becomes a question with a time and a scope.
Dependency mesh
One dependency at the edge starts being watched as the origin.
Event axis
Illustrative · no time scale
Dependency mesh
Illustrative schematic
State by layer
- Edge
- Identity
- Application
- Data
Nodes 17
Isolated 0
Cuts 0
Restored 0
- Nominal
One dependency at the edge starts being watched as the origin.
A hypothetical environment drawn for this page. It does not represent the architecture, the systems or the data of any organisation.
02Relation
Correlate
One isolated signal is not an incident.
Relating the event to the dependencies it touches is what separates an alarm from an incident. The path between systems is reconstructed before any irreversible action.
- 01Path across dependencies reconstructed
- 02Signal separated from competing noise
- 03Cause hypothesis recorded, not assumed
Dependency mesh
Illustrative schematic
State by layer
- Edge
- Identity
- Application
- Data
Nodes 17
Isolated 0
Cuts 0
Restored 0
- Nominal
- Event path
The event path crosses four layers and is traced end to end.
Event axis
Illustrative · no time scale
03Decision
Contain
Containment is deciding what stops.
Containment is a business decision executed with technical precision: what gets isolated, what keeps running, who owns that call, and how the cut is reversed afterwards.
- Isolation perimeter defined and executed
- Dependencies cut in a reversible way
- Executive communication on fact, not conjecture
Dependency mesh
Illustrative schematic
State by layer
- Edge
- Identity
- Application
- Data
Nodes 17
Isolated 3
Cuts 6
Restored 0
- Event path
- Severed link
The perimeter closes over three dependencies. Six links are cut.
A hypothetical environment drawn for this page. It does not represent the architecture, the systems or the data of any organisation.
The point of decision
Containment is not a reflex. It is the choice, made under pressure and on incomplete information, of what stops running so the rest can continue — and of who signs that choice.
No response removes risk. What coordination preserves is the ability to decide on evidence while the event is still in progress.
Readiness in three movements
Prepare
- Response plan and roles
- Executive simulations
- Logging and evidence
- Backup and recovery validation
Respond
- Triage and coordination
- Containment decisions
- Specialist mobilisation
- Executive situation reporting
Recover
- Secure restoration
- Root cause analysis
- Control remediation
- Lessons and board report
Event axis
Illustrative · no time scale
04Order
Recover
Dependency mesh
Illustrative schematic
State by layer
- Edge
- Identity
- Application
- Data
Nodes 17
Isolated 0
Cuts 0
Restored 6
- Nominal
- Event path
The severed links come back one at a time, in dependency order.
Restore in order, not in haste.
Coming back is a sequence, not a button. The order of return is dictated by dependency, and each return is verified before the next one starts.
- Restoration ordered by dependency
- Verification before reconnection
- Evidence preserved for the analysis
Event axis
Illustrative · no time scale
Order of restoration
- 01
Identity and access
Authentication, privilege and administration paths before any service takes traffic again.
- 02
Data
Integrity and provenance verified before reconnection, with incident evidence preserved separately.
- 03
Services
Return by dependency, one at a time, under active observation at every step.
- 04
External surface
What talks to the world comes back last, under verification and with a defined rollback criterion.
Return criterion
A step only advances when the previous one is verified. An unverified return is a second incident waiting for its moment.
Engagement models
- Readiness sprint
- Executive simulation
- Incident retainer
- Response coordination
- Post-incident recovery and hardening
05Control
Evolve
The missing control starts to exist.
The incident ends when the system changes. What was a crisis decision becomes a permanent control, the alternate route gets designed, and the baseline is rewritten.
Dependency mesh
Illustrative schematic
State by layer
- Edge
- Identity
- Application
- Data
Nodes 17
Isolated 0
Cuts 0
Restored 6
- Nominal
- Permanent control
An alternate route now exists and the event path becomes a control.
- Root cause documented and reviewed
- New control built into the architecture
- Baseline and rehearsal updated
Event axis
Illustrative · no time scale
How Ordfall protects the relationship
Trust is an operating system.
Every engagement is governed by authorisation, least privilege, evidence discipline and explicit accountability.
Data handling
Classification, minimisation, encryption, retention and disposal defined by scope.
Access
Named users, strong authentication, least privilege and reviewable paths.
Authorisation
Written scope and rules of engagement before any active testing.
Evidence
Traceable findings, reproducible decisions and executive reporting without unnecessary exposure.
Independence
Recommendations driven by outcome, risk and the client's own architecture.
Continuity
Backups, response, handover and documentation built into the delivery.
Delivery aligned to frameworks
- NIST CSF
- CIS Controls
- ISO 27001 readiness
- SOC 2 readiness
- OWASP
- PCI DSS
- LGPD
- Client-specific controls
AlignedFrameworks are a method reference and a shared language between technical and executive fronts. Alignment and readiness describe how the work is conducted — they are not claimed certifications.
Resume
The line ends where the decision begins.
What is above describes how the work is conducted. The conversation starts from the decision at hand, not from a catalogue.
Describe the context, the constraint and the open decision. The initial reading comes back with the engagement model that fits.
The working architecture behind the response: how diagnosis, operation and engineering connect.
Scope, authorisation and rules of engagement are agreed in writing before any technical work begins.