05 / Respond / Incident response retainer
IncidentResponse Retainer
Do not look for a responder during an incident.
A retainer puts terms, contacts and access in place before you need them.
What you get
- Pre-agreed terms and a named escalation contact
- Onboarding so responders already know your environment
- Response and forensics support when an incident starts, with access to our 24/7 emergency line (877-778-2476)
How an engagement runs
From first call to lessons learned
Every response follows the same five phases, whether you have a retainer or call us in an emergency.
Intake and triage
Hour 0 to 4
We take the call or detection, collect the initial facts, assign a severity, mobilize the right people, confirm access and open the case record with a running timeline.
Containment
Hour 1 to 24 and beyond
Isolate affected systems, accounts and network segments, preserve volatile evidence and key logs, disable compromised accounts and reset credentials, and keep your leadership updated.
Investigation and analysis
Build the attacker timeline from initial access to objectives, identify patient zero, compromised accounts and scope, analyze memory, disk, logs and EDR telemetry, and determine whether data was accessed or taken to support notification decisions.
Eradication and recovery
Remove malware, backdoors and persistence, rebuild or restore from known-good sources, validate before systems return to production, and support credential resets and heightened monitoring.
Lessons learned and reporting
An incident report with an executive summary, technical timeline and recommendations, a lessons-learned session, updated detections and playbooks, and a closed case with evidence archived under retention policy.
Phase windows are targets and vary with the incident.
How we classify incidents
Severity
- P1, Critical: active ransomware, confirmed data exfiltration, critical system compromise, or likely regulatory notification
- P2, High: confirmed intrusion, malware that could move laterally, or significant business impact
- P3, Medium: suspicious activity needing investigation, with limited confirmed impact
- P4, Low: informational or contained events, with monitoring recommended
Retainer or emergency call
- Retainer: pre-agreed response service levels, pre-positioned access, an annual tabletop exercise and priority queuing
- Emergency call: triggered by your call or a detection. We put a signed response agreement in place as the call begins, then scope and mobilize right away
Common questions
What does an incident response retainer cover?
A retainer puts terms, contacts and onboarding in place before an incident, so responders already know your environment when you call. The specific services and hours are set in your agreement. See also incident response planning and digital forensics.
Does cyber insurance require one?
Some policies expect or prefer a pre-arranged responder, and some require you to use the insurer’s approved vendors. Check your policy and talk to your broker before you sign, and tell us your carrier so we can coordinate.
Service levels
Response times for a retainer are set in your agreement. Our default targets, when an agreement does not set its own, are:
| Priority | Acknowledged within | Target response |
|---|---|---|
| Critical | 15 minutes | 4 hours |
| High | 1 hour | 8 hours |
| Medium | 4 hours | 24 hours |
| Low | 8 hours | 72 hours |
- Tickets confirmed to you within 1 hour and assigned to an analyst within 1 hour
- Status updates at least every 24 hours while a ticket is open
- A monthly security report in the first week of each month
- A quarterly business review in the first week of each quarter
These are default targets. If your agreement sets its own service levels, those take precedence.
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call (877) 77-vCISO.