NFIR Incident Response Service is a professional cybersecurity incident response offering provided by NFIR, a certified Computer Emergency Response Team (CERT). The service is available 24/7 and aims to deploy a response team on-site within three hours of an incident being reported. The service addresses security incidents such as ransomware attacks, data breaches, unauthorized access, and general cyberattacks. NFIR follows incident response procedures based on NIST and SANS frameworks, and can also adapt to a client's existing IR procedures. The response process is structured around three phases: - **Triage**: Identifying the source(s) and affected systems, setting priorities, and forensically preserving evidence for further investigation. - **Containment**: Restoring affected systems and verifying security to resume normal operations. - **Post-Incident Activities**: Producing a legally valid forensic investigation report with recommendations to prevent future incidents, and providing support for communication with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), legal counsel, and other relevant parties. The IR team consists of digital forensic investigators, ethical hackers, and team leads. Reports produced are legally admissible and can be used as evidence in legal proceedings or for data breach notifications. NFIR holds ISO-27001, ISO-27002, and ISO-9001 certifications, verified by BSI. The CERT designation was granted by Carnegie Mellon University in January 2020. The service is available to individuals, SMEs, government bodies, multinationals, educational institutions, and non-profit organizations.