Incident Response and Digital Forensics
Incident Response Retainer
We prepare the team to call, the access route, and the evidence collection method in advance. When an incident occurs, the first hours are spent on response, not contracts.
What it is
An incident response retainer is a service agreement signed before any incident. Scope, confidentiality, and pricing are defined up front. Our team learns your environment in advance and sets up the remote access route with you. The evidence collection tool is tested on your systems beforehand.
Scope
- Contract, non-disclosure agreement, and pricing signed in advance
- Incident reporting channel and team activation steps
- Familiarization with your critical systems and log sources in advance
- Testing the remote access route and evidence collection tool in advance
- Response start times defined in writing in the agreement
The need
When organizations need it
- When the board asks who to call in the first hour if a ransom note is found overnight.
- When your procurement process cannot sign a new supplier within a few days.
- When there is no in-house team able to conduct a forensic investigation.
Method
How we work
-
Agreement
We define the scope, response start times, and pricing in writing.
-
Onboarding
We learn your critical systems, log sources, and decision makers in advance.
-
Access and tooling
We set up the remote access route and test the evidence collection tool on several systems with you.
-
When it happens
The team is activated upon your notification. The first task is to preserve evidence and contain the impact.
Outcome
What you have at the end
When an incident occurs, the contract, access, and tooling are ready. As the team knows your environment, response starts with evidence collection in the first hour.
Frequently asked questions
How quickly does the response start?
Start times are defined in the agreement to fit your needs. With the access route already set up, remote work begins without waiting for an on-site team.
Is the retainer wasted if no incident occurs?
No. Gaps identified during onboarding, such as short log retention, are addressed before any incident. A readiness assessment or exercise can also be included in the agreement.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting