Incident Response Retainer

$7,500.00

Retained response with a four-hour engagement SLA: containment, forensics and root-cause analysis when something has already gone wrong.

Incident response works when the paperwork is already done. A retainer means contracts, contacts and access are agreed in advance, so the first call is about containment instead of procurement.

What the engagement covers

Pre-agreed contract, contacts and escalation path
Four-hour engagement SLA, 24/7
Containment and eradication support
Host, network and cloud forensic analysis
Annual readiness review and tabletop exercise

What you receive

Incident timeline and root-cause analysis
Containment and recovery action log
Executive and, where required, regulator-ready reporting
Post-incident hardening recommendations

Typical duration: Annual retainer; response begins within four hours of activation
Pricing: the listed figure is a starting point; final price follows a scoping call and depends on the size of the environment.
Authorisation: testing begins only once a scope and authorisation letter is signed by an accountable owner of the systems in scope.

Request a scoping call