Skip to content
Valmius

Incident response, practiced

Write the plan.
Run the drill.
Keep the proof.

Valmius is for companies with 10 to 200 employees and nobody whose full-time job is security. It writes your incident response plan, runs the tabletop exercise with your team, and produces the dated after-action report that auditors, insurers and regulators ask for.

Generate a free tabletop scenarioNotify me at launch

The free generator is live today. The full product is in development.

The Valmius plan editor: an incident response plan with numbered sections and framework references

Why now

What the people who check your work ask for

Four requirements that come up for almost every company our size. Each one wants a written plan and a dated record that it was tested.

PCI DSS 12.10.2
Review and test the incident response plan at least once every 12 months.
SOC 2 CC7.4
Respond to identified security incidents through a defined program. Auditors expect at least annual tabletop evidence.
Cyber insurance questionnaires
Do you have an incident response plan, and when did you last test it?
NYDFS 500.16
Maintain a written incident response plan and test it at least annually.

How it works

Three steps, one record

  1. Plan

    A written plan from fifteen questions

    Answer fifteen questions about your systems, people and obligations. Valmius writes an eleven-section incident response plan with roles, severity levels and a notification matrix built from your actual deadlines. Edit any section, approve it by name, export PDF or Word.

    The plan editor showing the roles and responsibilities section with a table of roles, backups and duties

  2. Drill

    A tabletop exercise your team can run in an hour

    Pick a scenario or generate one from your own plan. The facilitator console shows one inject at a time with discussion questions; every decision is logged with a server timestamp. Participants follow along on their phones and sign off at the end.

    The facilitator console with the current inject, the decision log and the timer

  3. Prove

    A dated report an auditor accepts

    Attendance, the decision timeline, strengths, gaps, action items with owners, and the controls the exercise evidences, in a PDF with a recorded SHA-256. The evidence vault shows every exercise and when the next test is due.

    An after-action report with the participants table and the decision timeline

Your cloud provider inherits the data center. Your compliance platform automates the configuration evidence. Your team still has to practice the response. We cover that last part.

Scope, exactly

What we cover, and nothing broader

Valmius produces the evidence auditors ask for under these controls. It does not make a company compliant; no single tool does.

  • SOC 2 (TSC 2017)CC7.3, CC7.4, CC7.5
  • PCI DSS v4.0.112.10.1, 12.10.2, 12.10.6
  • ISO/IEC 27001:2022A.5.24, A.5.26, A.5.27
  • NIST CSF 2.0ID.IM-02, ID.IM-04
  • HIPAA Security Rule164.308(a)(6)(ii)
  • CMMC 2.0 L2 / NIST 800-1713.6.1, 3.6.2, 3.6.3
  • NYDFS 23 NYCRR 500500.16

Launch

Be the first company to run a drill

Leave your work email and we will tell you when the plan generator, the exercise runner and the evidence vault open up.

Used only for the launch announcement. Nothing is emailed to you today.