Respond and recover after a
security incident
Microsoft Services
Microsoft Incident Response
and Recovery Process
Potential Benefits
• No additional contract actions
required to execute support
during time of crisis
• Expected initial telephone
response from Support
Engineer within 60 minutes
• Coordinated escalation and
triage process to determine
severity and align additional
resources for on-site
deployment if necessary
Customers with a Premier Support Agreement have on-demand access to
highly specialized Security Support Engineers and on-site Incident
Response teams. For customers with an existing agreement, no additional
contracting action is necessary to initiate Incident Response activities
from Microsoft.
Microsoft’s incident response and recovery process gives you access to
expert security services that can scale to provide the appropriate
response to your specific incident. Depending on the severity of your
incident, we can provide anything from telephone support to dedicated
on-site Incident Response teams that deploy custom tools and perform
on-site malicious software reverse-engineering to investigate and contain
a breach. Our rapid response time helps your organization effectively
contain, respond to and recover from a security incident.
• Rapid response time enables
an organization to effectively
contain, respond, and recover
from a security incident
© 2015 Microsoft Corporation. All rights reserved. This description is for informational purposes only. MICROSOFT MAKES NO
WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Microsoft is either a registered trademark or trademark of the
Microsoft group of companies.
Incident Response Solution Details
Potential event discovered
You have discovered or suspect an ongoing security incident.
Open severity “A” case
You or your Technical Account Manager opens a severity “A” case with
the security team.
Initial response
A Security Support Engineer contacts you on the telephone for initial
triage and response action. (est. 60 minute response time)
Coordination
Microsoft teams mobilize for escalation support and on-site deployment
options as required.
Deploy
Onsite Incident Response team deploys to your location to continue
containment, response and recovery actions as necessary.
Why Microsoft Services
Comprehensive Approach
With comprehensive Security and Identity services across strategy and
planning, implementation and ongoing support, we can help your
business implement seamless, consistent solutions that align with your
strategic goals.
Unparalleled Access
With direct access to product development teams, we can take advantage
of our security and identity products’ latest capabilities to create,
integrate and optimize solutions that help protect your business and drive
innovation.
Highly Skilled Resources
Trusted to help protect the world’s largest organizations and on the
forefront in the fight against cybercrime, our diverse group of technical
professionals are highly trained experts offer you a wealth of security and
identity experience.
For more information about Consulting and Support solutions from Microsoft, contact your
Microsoft Services representative or visit www.microsoft.com/services