Structure your incident response from the moment it starts.
When an incident hits, the scramble to find the right people, the right plan, and the right procedures costs critical time. BastionIQ Command gives your team a secure out-of-band command room, linked to everything they need. It includes Offline Mode, so it works even if your primary systems are compromised.
When an incident hits, teams typically spend 20–45 minutes just finding the right contacts and the right plan.
The DR plan is in a SharePoint folder someone can't access. The right contact's number is in a spreadsheet that nobody kept up to date. The incident log is a shared Word doc being edited simultaneously by four people. None of this should be happening when your business is under attack.
BastionIQ Command puts everything in one place: linked, pre-loaded, and accessible even when your primary systems are down. From declaration to close, your team knows exactly where to go and what to do.
From declaration to post-incident review
Declare the incident
Set the incident type and severity (Low, Medium, High or Critical) and link the plans, runbooks, contacts and infrastructure your team needs. Members are emailed for High and Critical incidents.
Coordinate your team
Assign actions (assignees are notified by email) and log the timeline as you go. Move the incident from Active to Monitoring, Resolved and Closed.
Communicate with stakeholders
BastionIQ drafts communications for internal staff, leadership and the board, customers, and the press or public, in the right format for each channel. Edit before you send.
Close and review
The timeline, actions and communications form a complete post-incident record, protected by a SHA-256 integrity hash so any tampering is evident.
What's in Bastion Command
Severity levels with AI triage assistance
Classify incidents as Low, Medium, High or Critical, with AI triage assistance to help you assess what you’re dealing with. High and Critical incidents trigger email alerts to members.
Timeline, actions and status
Log every update on the incident timeline, assign actions to named people who are notified by email, and track status from Active through Monitoring, Resolved and Closed.
Linked plans, runbooks and contacts
Link the relevant plans, runbooks, contacts and infrastructure to the incident, so your team isn’t searching for them in the first hour.
AI-drafted communications
Drafts for 4 audiences (internal staff, leadership/board, customers, press/public) across 5 channels: email, Microsoft Teams, Slack-formatted messages, SMS/push and public statement or press release.
Microsoft Teams integration
With the Integrations add-on, each incident gets its own private Teams channel with a summary card, and you can message the channel from the command room. Learn more →
Tamper-evident record
A SHA-256 integrity hash on the incident record makes any tampering evident, which is useful for post-incident forensics, insurance claims and regulatory review.
Not minutes, to activate your team
Teams without a structured command room spend 20–45 minutes in the first hour of an incident just finding contacts, plans, and procedures. BastionIQ Command puts everything in one place the moment an incident is declared, so your team can act, not search.
Built for the scenario where it matters most.
In a ransomware or major infrastructure incident, your systems may be the thing that's down. Bastion Command includes Offline Mode: plans, runbooks, contacts and infrastructure are encrypted on enrolled devices, with no internet required. Declare and log incidents offline. They sync when you reconnect and are marked as declared offline. Learn more about Offline Mode →
Be ready before the next incident.
Free 30-day trial with Command included. No credit card required.