Do you offer an incident response retainer?
Yes — retainers guarantee 1-hour response SLAs, with pre-agreed rates and pre-authorised investigators on standby 24×7.
Extended FAQs
Extended FAQs — Digital Forensics & Incident Response (DFIR)
Extended answers to the questions buyers, boards and procurement teams ask before commissioning Digital Forensics & Incident Response (DFIR).
- ISO/IEC 27001 Certified
- ISO/IEC 27701 Certified
- ISO 9001 Certified
Delivered by an ISO/IEC 27001, 27701 & 9001 certified organisation
Is your evidence handling court-admissible?
Yes. We follow ACPO and NIST SP 800-86 guidelines with full chain-of-custody documentation.
What incident types do you handle?
Ransomware, business email compromise (BEC), insider threat, data breach, financial fraud, intellectual property theft, cloud account takeover and nation-state intrusion.
Do you negotiate with ransomware actors?
We coordinate with specialist ransom-negotiation partners and OFAC-screened payment facilitators where leadership decides negotiation is necessary. Our default position is recovery, not payment.
Will you work with our cyber insurer?
Yes — we are on the panels of major regional and global cyber insurers and align scope, rates and reporting to their incident-response requirements.
Can you support law-enforcement reporting?
Yes — we coordinate with UAE Cyber Crime Centre, SAMA-CERT, CERT-IN, CBUAE and law enforcement as required, with evidence packs prepared to a court-admissible standard.
How fast can you mobilise without a retainer?
We can typically have a triage call inside 4 hours and forensic responders onsite or remote within 24 hours. Retainer clients get a 1-hour SLA.
Will you provide a final, signed report?
Yes — every engagement closes with a written report covering scope, timeline, root cause, remediation and lessons learned, signed by the lead investigator.
How experienced is the team that will actually deliver Digital Forensics & Incident Response (DFIR)?
Every engagement is led by a partner or principal with at least 12 years in cybersecurity and supported by certified consultants (CISA, CISM, CISSP, CIPP/E, ISO 27001 Lead Auditor, ISO 42001 Lead Implementer, OSCP, CREST). You meet the actual delivery team before contracts are signed.
How do you handle confidentiality and data residency?
All client data stays within the regions you authorise. NDAs are signed before scoping calls, and we offer fully on-premise delivery for sensitive engagements. For UAE and KSA clients, evidence remains in-country by default.
Can MAST work alongside our existing Big 4 auditor?
Yes. We routinely collaborate with EY, Deloitte, KPMG, PwC, BDO and Grant Thornton as your implementation partner while they retain audit independence. Roles are agreed upfront in writing to preserve auditor independence rules.
Do you offer multi-year continuous compliance?
Yes — our Managed Compliance Service operates the programme on a monthly subscription, covering control monitoring, evidence collection, internal audit and recertification across every framework in scope.
How is success measured?
Success criteria are agreed in the engagement charter — typically a passed certification or regulator submission, an audit-ready evidence repository, trained control owners and a 12-month continuous-improvement plan.