ZA Support · Johannesburg
Business Mac Security Incident Response
A suspected compromise can involve a Mac, email account, cloud service or remote-access session. ZA Support handles the technical investigation, preservation, reporting and recovery work within an agreed mandate. Legal representation and regulated representation are handled by the appropriate qualified partners.
Set the mandate and immediate priority
Identify the authorised business contact, affected devices and accounts, observed events and critical services. Agree whether the immediate objective is containment, evidence preservation, service restoration or a combination. Record changes already made.
Contain without losing the investigation
Containment can change volatile data and disrupt business services. Record the reason, time and person responsible for each action. Collection should be limited to the approved scope, with particular care around personal accounts, employee privacy and third-party information.
Investigate devices and identities
Relevant work can include Mac persistence review, remote-access configuration, account access records, email rules, suspicious applications and a timeline of available events. Log retention, permissions, encryption and provider access can limit what can be established.
Reporting and partner roles
The report separates observations, analysis, supported conclusions and limitations. ZA Support conducts the substantive technical work. Appropriately qualified PSIRA partners can review process and provide relevant sign-off within their mandate; legal practitioners advise on legal process and representation.
Partner sign-off does not bind a court or guarantee admissibility. Where litigation, employee disputes or criminal allegations are involved, obtain case-specific legal direction before extending collection.
Restore and verify
Agree the remediation plan, account actions, recovery priorities and post-change checks. Preserve required records before removing software or rebuilding a device. Report which checks passed and what remains unresolved.
Privacy and notification decisions
A suspected incident is not automatically proof of a reportable breach. The organisation should assess legal obligations with its information officer and legal advisers using the actual facts. Do not send raw incident evidence or personal information through general marketing forms.
Further reading
Indicative pricing only. Final pricing is confirmed once ZA Support verifies your device model and serial number.
Pricing is confirmed on assessment and depends on your specific device. Contact ZA Support on 064 529 5863 with your model and serial number for a confirmed quote.
Processing and lead times are indicative only and depend entirely on your specific machine.
The repair process and turnaround time change based on the model, the fault, and the parts your device needs. You will only have a confirmed lead time after you enquire and speak to a ZA Support consultant who assesses your machine. Contact us on 064 529 5863.