
| Governance | Light RACI; weekly sync; joint risk review |
|---|---|
| Interfaces | Telemetry sharing; who executes which step; evidence capture |
| Change | CAB etiquette; dry‑run and rollback rehearsed |
| Comms | Client Comms Lead; holding statements; coordinated notices |
We lead triage; MSP isolates hosts; SaaS owner purges/ZAP; backup provider confirms immutability and clean restore points; go/no‑go captured in Decision Log.