Incident Response & Digital Forensics

Incident Response Retainer

A named team, a guaranteed response time and a contract already signed when it matters.

The situation

The worst time to negotiate an incident response contract is during an incident.

A retainer secures response-time commitments, pre-agreed rates and — most valuable of all — a team that already knows your environment, your escalation path and your regulatory notification obligations before the first alert. Unused retainer hours convert to proactive work: exercises, playbook development or compromise assessment.

What the client receives

Schedule of deliverables

01Contracted response SLA with named responders
02Pre-engagement environment and contact discovery
0324/7 escalation path and secure out-of-band communication channel
04Incident triage, containment, eradication and recovery support
05Regulatory notification support (NIS2 24h/72h, DORA, GDPR 72h)
06Post-incident report and lessons-learned review
07Unused hours convertible to proactive services

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

NIST SP 800-61r3
ISO/IEC 27035
ENISA IR guidance
MITRE ATT&CK

Incident Response & Digital ForensicsIncident Response Planning & PlaybooksPlans written by people who have run the incident, not the template.Service detail Incident Response & Digital ForensicsCompromise AssessmentAnswer the question 'are we already breached?' before the attacker answers it for you.Service detail

Discuss this engagement

Tell us about your environment and the response commitments you need in place and we will set out the scope, the method and the reporting format.