Incident Response Retainer
Arrange your response before you need it.
The worst possible time to select an incident response provider is during an incident.
Procurement takes days you do not have. Nobody knows your environment. Contracts, data processing terms and access approvals all have to be negotiated while systems are down and the clock on regulatory notification is already running.
A retainer removes all of that from the critical path. The commercial terms are already agreed, the escalation route already exists, and the people answering the phone have already seen your architecture.
Everything agreed in advance, so response starts immediately.
Pre-Agreed Terms
Commercial terms, data processing agreements, rates and response commitments signed before an incident, not during one.
Named Escalation Route
A defined activation path with named contacts on both sides, so nobody is searching for a phone number at two in the morning.
Environment Onboarding
We map your architecture, critical services, logging and key contacts up front, so responders start informed rather than starting with questions.
Playbook Development
Response playbooks for the scenarios most likely to affect you — ransomware, business email compromise, data exposure, third-party compromise.
Annual Exercise
A tabletop exercise each year to test the plan and the people, because an untested playbook is a document rather than a capability.
Live Incident Support
Technical investigation, containment guidance and coordination through the incident, alongside your internal teams and suppliers.
Regulatory Notification Support
Help assessing whether notification thresholds are met and support preparing what regulators, customers and insurers will ask for.
Post-Incident Review
A structured review after the event: what happened, what worked, what did not, and the specific changes that follow.
Unused Hours Put to Work
Where hours go unused in a quiet year, they can be applied to readiness work rather than simply expiring.
A response capability that already exists.
Contracted, briefed and rehearsed before it is needed — so the first hour of an incident is spent responding rather than procuring, explaining and improvising.
Often combined with
Put the response in place while things are calm.
A retainer takes a short scoping conversation and an onboarding session. Both are considerably easier now than during an incident.