An Incident Response Retainer is a contractual agreement that provides your company with guaranteed support, defined response times, and prioritized access to incident response specialists.
In the event of an emergency, the Oneconsult International Computer Security Incident Response Team (OCINT-CSIRT) is immediately available to assist you to quickly analyze, contain, and professionally manage cyber incidents.
In addition, you will benefit from preparatory measures such as workshops, exercises, and assessments designed to continuously improve your organization’s technical and organizational responsiveness.
In a crisis, speed is of the essence. As a retainer client, your incident will be treated as a priority, allowing our OCINT-CSIRT to begin analysis and support immediately upon notification.
Cyberattacks don’t adhere to business hours. Our incident response team is available around the clock and will assist you at any time with security-related incidents.
In the event of a cyber incident, you will benefit from contractually guaranteed response times. This means that it is established in advance within what timeframe our incident response specialists will assess the situation, coordinate the response, and assist with initial containment measures.
Depending on the situation, we will support you either remotely or directly on-site. If an on-site response is required, we will mobilize our specialists within the agreed-upon guaranteed response times.
In the initial workshop, we will lay the groundwork for efficient collaboration. We will gain an overview of your infrastructure, define communication channels, and coordinate responsibilities and escalation processes. To ensure no time is lost in an emergency, we will verify the technical use of our tools and the necessary permissions during the onboarding process. Starting in the second year of the contract, you will also benefit from an interface review that ensures responsibilities and processes remain up to date.
As part of our Digital Forensics and Incident Response (DFIR) Readiness Assessment, we will analyze your company’s technical and organizational preparedness for cyber incidents. You will receive specific recommendations for action to improve processes, responsibilities, and technical requirements in a targeted manner. This enables security incidents to be detected more quickly, handled more efficiently, and their impact minimized.
With the Incident Response Retainer, you will benefit from an annual tabletop exercise to practice responding to simulated cyber incidents with key personnel in a controlled environment. This trains processes, responsibilities, and procedures so that they remain operational even under stress.
Unused services do not expire. The credit included in the optional “Forensics Quota (Capped)” module remains valid indefinitely and can also be used for services provided by other Oneconsult departments (e.g., for a Penetration Test, an awareness presentation, etc.).
You receive the following content with the Basic package:
Minimum contract period of one year.
You receive the following content with the Journey package:
Minimum contract period of one year.
You receive the following content with the Odyssey package:
Minimum contract period of three years.
An incident response retainer is a framework agreement concluded in advance with a specialized cybersecurity service provider that guarantees immediate, prioritized response capabilities with contractually defined response times in the event of a security incident. Companies need such a retainer because, in an emergency – such as a ransomware attack, a data breach, or an exploited vulnerability – every hour of delay can lead to significant financial and reputational damage. With a retainer in place, the incident response team is already familiar with the company’s infrastructure and can act immediately.
An incident response retainer is particularly worthwhile for companies that want to improve their ability to respond to cyberattacks and avoid wasting time searching for external specialists in an emergency. The service reduces organizational and technical delays during an incident.
An Incident Response Retainer provides support for a variety of security incidents, such as ransomware attacks, data theft, insider threats, fraud, and other cyberattacks. The specific support provided depends on the nature of the incident and the agreed-upon services.
The Oneconsult International Computer Security Incident Response Team (OCINT-CSIRT) responds to reported incidents within the contractually specified response times. Starting with the Journey and Odyssey packages, an additional 60 minutes per reported incident is included to receive an immediate assessment of the incident at no cost. The exact response times are specified individually in the retainer agreement.
Incident response refers to the operational response to a specific cyber incident. An Incident Response Retainer supplements this service with a long-term agreement that includes guaranteed availability, defined response times, and preparatory measures such as workshops, exercises, and readiness assessments.
Choosing the right package depends on the size of the company, its risk profile, and its internal response capabilities. The Basic package is suitable for organizations that need reliable basic protection with 24/7 access and guaranteed response times. The Journey package is suitable for companies that also want to measure and improve their response readiness annually with a DFIR Readiness Assessment. The Odyssey package offers comprehensive protection against cyberattacks, including the one-time creation of an Incident Response Plan and an annual DFIR credit of 24 hours.
The credit from the optional “Forensics Quota (Capped)” module remains valid indefinitely. You can use it flexibly for services offered by other Oneconsult departments, such as a penetration test, an awareness presentation, workshops, training sessions, or consulting services. This way, your investment is preserved, and your budget can be used as needed.
No two security incidents are alike – but the initial signs and proven responses follow a clear pattern. Talk to our incident response specialists and work with them to lay the groundwork for a rapid, coordinated response. We will provide you with a no-obligation consultation on the scope, duration, and package selection.
Availability Monday to Friday 8:00 a.m. – 6:00 p.m (exception: customers with SLA – please call the 24/7 IRR emergency number).
Private individuals please contact your trusted IT service provider or the local police station.
For more information about our DFIR services here:
Don’t miss anything! Subscribe to our free newsletter.
