Incident response retainers: find out what starts when you call

A two-hour response commitment does not tell a CISO when the business will be back in operation. It tells them something about a defined stage of the response. Understanding that stage is the first job when comparing incident retainers.

For example, Mandiant’s published Incident Response Retainer datasheet describes initial contact by email or phone within two hours, with a responder able to help triage the incident. It separately describes case acceptance once Mandiant and the client decide incident response services are needed. That is useful detail: a buyer can distinguish the first expert conversation from the subsequent engagement, instead of reading a response time as a restoration guarantee.

The retainer’s value is the capability it makes available when your own team needs help. Its price should be judged against that capability, the conditions for using it and the work your organisation must still perform.

Follow the call into actual work

Ask each bidder to walk through a suspected compromise from the first call. Who is authorised to activate the service? Which contact route starts the commitment? What information is required, and what happens if the evidence is incomplete? Establish what the provider will do immediately and which activities require further agreement.

Separate acknowledgement, access to an incident responder, remote investigation, on-site attendance and sustained delivery. A supplier may offer a firm commitment for one and a different arrangement for another. Compare the same milestone across bids, including the definition of when its clock begins.

Then ask about scale. One compromised endpoint and a multi-country identity incident demand different staffing and expertise. Establish the supported technologies, locations, languages and working hours for the scope you need. Ask how the provider handles simultaneous incidents across customers and which commitments remain applicable during a widespread event. Do not turn an unanswered capacity question into an assumption of unlimited resources.

Guaranteed availability, priority access and prepaid consulting time describe different commercial benefits. Prepayment can simplify authorisation and pricing without, by itself, settling who will be available or how quickly the work begins. Have the provider identify the wording that covers each requirement in the proposed agreement.

Buy the handover as well as the investigation

Trace the proposed work through evidence collection, analysis, containment advice, technical remediation and restoration. For each stage, distinguish advice from execution. An expert recommendation to rebuild a server is different from a team that will perform the rebuild, validate the application and support the next trading day.

In a hypothetical incident, the retainer covers remote investigation and recommendations, while the internal infrastructure team must restore the affected service. If that team has no capacity to rebuild the environment, the investigation can succeed while recovery remains blocked. The missing capability needs a funded internal plan or an additional service before an incident exposes it.

Agree the outputs that make the next team’s work possible: the affected scope, actions already taken, evidence locations, unresolved questions and the assumptions behind recovery advice. Ask who maintains the live incident record and how material findings reach the incident commander. A final report delivered after the operational handover cannot substitute for timely information during it.

Access is another dependency. Responders need an authorised way to reach systems and obtain relevant logs when normal collaboration is disrupted. Google’s Mandiant Consulting terms make timely customer cooperation and access explicit obligations. Test your side of that arrangement: a signed retainer will not restore a missing administrative route or recover logs that were never retained.

Price the incident you would actually activate

Request a scenario-based quotation that makes the cost boundary visible. Include the response team, expected duration, specialist work, technology charges, travel and out-of-hours treatment where relevant. Establish the authority to approve additional work and what happens when prepaid value is exhausted.

Unused value deserves attention too. Mandiant’s current Retainer terms describe a twelve-month covered period, services drawing down retainer units, and expiry of unused units. They also distinguish technology fees and expenses. That is a reason to understand the purchased unit and its expiry, rather than treating every retainer as a refundable bank of interchangeable hours.

If proactive work can use the balance, choose work that improves readiness: a practical exercise, preparation for evidence collection or a tested containment route. Confirm scheduling and whether that use affects the capacity or value available for a later incident. The availability component may still be valuable in a year without activation, but that value should be understood rather than disguised as unused labour.

Resolve insurance-panel, evidence-handling and legal-engagement requirements with the people responsible for those arrangements before purchase. Do not assume that a supplier’s technical reputation establishes that a particular incident or engagement will satisfy your policy conditions.

Exercise the boundary with your existing service

Run an activation exercise involving the incident lead, a deputy, the provider and the team responsible for recovery. Test contact details, authority, access and the first useful handover. Record and repair the places where one participant expects another to act.

Keep the retainer’s role distinct from continuous monitoring. An ongoing MDR provider may detect an incident and perform agreed response actions; a retainer may bring additional investigation or specialist capacity when activated. The exact split depends on the two contracts and your retained team.

Use the MDR operating-responsibility questions to check that boundary. The strongest retainer proposal is the one that fits the incident you need to manage, with a credible path from the first call to the work that restores the service.