Incident response retainer
A responder who already knows your environment.
A retainer sets things up before anything goes wrong. It starts with an assessment or a penetration test, so when something happens there is no cold start.
How it works
Set up before, so I can move fast during.
- 01
It starts with an assessment
Every retainer begins with an assessment, a penetration test, or an interim engagement, so I know your environment before an incident, not during one.
- 02
You buy a block of hours
The retainer is a block of prepaid hours, sized to your environment and quoted after a scoping call.
- 03
You get priority when it counts
When something happens, retainer clients come first, and because I have already assessed your environment there is no cold start.
What the hours cover
Response when you need it, readiness when you don’t.
When an incident happens, the hours cover the response and close-out. When one doesn’t, they go to the work that prevents the next one.
- Incident response plan
- A written plan for who does what when something happens: roles, contacts, decision points, and how you communicate, so the first hour is not improvised.
- Tabletop exercises
- We walk your team through a realistic scenario on paper, and find the gaps in the plan before a real incident does.
The same hours cover security advising, purple team exercises, and more assessment or testing.
The business case
Help starts from an environment already assessed, not a cold start. Hours not used on incidents go to readiness work, so the budget isn't wasted.
The compliance case
Supporting evidence for:
- SOC 2 CC7.4, CC7.5
- HIPAA §164.308(a)(6)
- HITRUST Domain 15
- ISO 27001 A.5.24
- PCI DSS 12.10.1, 12.10.2
- NIST CSF ID.IM-02, ID.IM-04
- NIST 800-53 IR-3, IR-8
References are to the 2017 Trust Services Criteria for SOC 2, the HIPAA Security Rule at 45 CFR Part 164, the HITRUST CSF assessment domains, ISO/IEC 27001:2022 Annex A, PCI DSS v4.0.1, NIST CSF 2.0, and NIST SP 800-53 Rev. 5.
Pricing
Prepaid hours, quoted after a scoping call.
The size of the block depends on your environment and how much readiness work you want. Whatever you don’t spend on an incident, you spend on the work above.
In an incident now?
No retainer in place yet?
If something is wrong right now and you don’t have a retainer, incident response covers one-off help, from containing it to the close-out report.
Start with a conversation.
The right engagement depends on what you’re building and where the gaps are. A 30-minute call gets us to whether and how I can help.