Incident Response Retainers: What to Check

Understand the support your retainer provides

An incident response retainer should make it easier to engage appropriate support when something goes wrong. The useful detail is in the agreed preparation, activation process, service commitments and commercial terms.

Retainers vary. Some combine readiness work with incident support; others provide a different set of benefits. Compare the actual agreement against your organisation’s needs and ask for unclear terms to be explained before signing.

Make activation straightforward

Ask how someone reports an incident, who may activate the retainer and what happens if the usual contact is unavailable. Keep the route accessible outside the systems that could be affected.

Check whether a telephone call, portal request or other step starts the engagement. Identify when acknowledgement, triage and further response are expected to occur. These are different events and should not be described interchangeably.

NCSC response planning guidance includes contacts across technical teams, management and relevant advisers. Its Cyber Incident Response Buyer’s Guide helps organisations assess suitable incident response support. ^[1]^[2]

Understand the service commitment

Ask what coverage applies to the package being quoted. Establish which activities have staffed coverage, which processes are automated and which commitments require an additional arrangement.

If a response target is offered, ask what starts the clock, what stops it and which activity the target covers. Confirm any dependencies, such as a safe contact, agreed access or the availability of someone authorised to approve actions.

Record the process if an incident occurs outside the defined scope or affects several organisations at once. Avoid relying on a broad availability statement to infer a specific investigation or recovery commitment.

Agree preparation before an incident

Useful onboarding discussions include:

The services and systems that matter most to the business.
Customer contacts, alternatives and decision-making authority.
Relevant security tools, evidence sources and access arrangements.
Safe communication if company email becomes unavailable.
Insurer, IT provider and other necessary supplier contacts.
How changes to this information will be maintained.

Ask which activities are included in the proposed package. Readiness reviews, exercises, incident hours or other benefits may be available under different arrangements; their inclusion should be explicit.

Define authority and responsibility

Responders need to know who can approve disruptive actions such as isolating a device or restricting an account. Where actions are authorised in advance, record the permitted circumstances and boundaries.

Also clarify who manages routine IT administration, business continuity, customer communication and recovery implementation. Several organisations may contribute. The important question is how their responsibilities fit together during an incident.

An illustrative question is: “If an affected identity account controls access to our finance system, who can approve its restriction and who checks the business workaround?” Work through that decision before it becomes urgent.

Compare the commercial terms

Ask for a clear explanation of:

Included work, any incident-hour allowance and how it is recorded.
Additional rates, minimum charges and approval for extra work.
Whether unused benefits expire, carry forward or can be used for preparation.
Any reserved-capacity commitment and its practical meaning.
Specialist support, travel or other expenses where relevant.
Renewal, cancellation and changes to package scope.

Treat this as a comparison checklist, not a description of benefits included in every retainer. A lower headline fee may represent a different service rather than a better value version of the same agreement.

Check deliverables and ongoing readiness

Agree what you receive during and after incident work: updates, investigation findings, evidence handling arrangements and recommendations. Check how information is protected, retained and returned.

Keep the arrangement current when systems, contacts or suppliers change. Revisit activation and decision-making through an exercise where that activity fits the agreed preparation plan.

Discuss an appropriate package

CyberXpert incident response retainers offer package options with different features and benefits. Discuss your environment and priorities so the appropriate arrangements can be agreed. For the internal decision process, read Preparing an Incident Response Plan.

Use a cyber incident tabletop exercise to check how the activation and decision-making arrangements work together.

What Should an Incident Response Retainer Include?