Incident Response
Support to triage, contain, investigate and recover from suspected or confirmed cyber incidents.
Learn more
Reactive Cybersecurity Services
Incident Readiness & Response
Incident Response Retainer
Agree terms, contacts and response targets now, so help can start without delay when you need it.
A retainer establishes agreed service entitlements and response arrangements. It does not guarantee a particular recovery outcome.
Overview
An incident response retainer is an agreement made before an incident. It defines how you activate support, who you contact, the service scope, availability and contractual response targets. Many retainers also include readiness activities so that our team already understands your environment. The retainer bridges proactive preparation and reactive response.
Business objectives
- Remove contracting delays at the start of an incident
- Secure priority access to responders
- Prepare in advance with known contacts and environment information
- Improve readiness through included exercises and reviews
Why it matters
Negotiating contracts and explaining your environment during an active incident wastes valuable time. A retainer settles these matters in advance.
Common challenges we address
- No incident response capability in-house
- Insurance, regulatory or customer expectations for response arrangements
- Concern about finding available responders during an incident
- Desire to combine readiness work with response coverage
Scope and key activities
- Onboarding and environment familiarization
- Agreed activation procedure and escalation contacts
- Incident response during the term, according to the agreement
- Optional readiness activities, such as tabletop exercises or plan reviews
- Periodic check-ins and contact updates
Methodology
Our approach
Work starts with an assessment of your needs and a written scope. Pricing follows that scoping and sizing.
- AgreeSelect the retainer model, scope and response targets.
- OnboardCollect contacts, environment details and existing plans.
- PrepareCarry out any included readiness activities.
- ActivateWhen an incident occurs, follow the agreed activation steps for priority response.
- ReviewReview the retainer and update arrangements periodically.
Retainer models
Pay-as-you-go retainer
Pre-agreed terms, contacts and activation process, with response time billed only when used.
Prepaid hours retainer
A block of prepaid hours that can be used for incident response or for readiness activities such as tabletop exercises.
Response targets, coverage hours and escalation paths are defined in each agreement after assessing your environment and needs.
Deliverables and outcomes
- Signed retainer agreement with defined scope and targets
- Activation guide and contact sheet
- Onboarding summary of your environment
- Readiness activity outputs (where included)
- Incident reports for any activations
Typical use cases
- Organizations without an internal incident response team
- Meeting cyber insurance or customer requirements
- Supplementing an internal team during major incidents
- Combining annual exercises with response coverage
Who it is for
- CISO
- CIO / IT director
- Risk and insurance managers
- Procurement and legal
Engagement options
- Retainer models as described above
- Optional tabletop exercise or plan review
- Annual renewal
Prerequisites
- Named authorized contacts
- Onboarding information about key systems and providers
- Agreement on terms before an incident occurs
Frequently asked questions
Does a retainer guarantee we will recover from an incident?
No. A retainer guarantees the agreed access, activation process and response targets. Outcomes depend on the nature of the incident and the state of the environment.
Can unused hours be used for other services?
This depends on the retainer model and is agreed in the contract.
Is this proactive or reactive?
Both. It is arranged in advance and can include readiness work, but its main purpose is to enable a fast response when an incident happens.
Related services
Complementary services
Tabletop Exercises (TTX)
Realistic incident scenarios that test decisions, escalation and communication before a real crisis.
Learn moreDigital Forensics
Forensic investigation of endpoints, servers, cloud and media, with sound evidence handling.
Learn moreRelated training
Build these skills in your team
Our courses teach the methods behind this service, for teams that want to strengthen their in-house capability.
GCIH prep
Intermediate
Incident Handling & Attacker Techniques
Detect, respond to and contain common attacks, and prepare for the GIAC Certified Incident Handler (GCIH) exam.
Fees on request
Details
GEIR prep
Advanced
Enterprise Incident Response at Scale
Lead incident response and threat hunting across large, hybrid environments, and prepare for the GIAC GEIR exam.
Fees on request
Details
GCFR prep
Advanced
Cloud Forensics & Incident Response
Investigate incidents in cloud and SaaS environments using provider logs, and prepare for the GIAC GCFR exam.
Fees on request
Details