What is an incident response retainer?

An incident response retainer is an agreement signed before any attack that reserves a team of experts to step in within an agreed time. It fixes on-call cover, scope, response times and billing in advance. When an incident hits, there is just one number to call, and no contract to negotiate.

This article is part of our incident response series. For the big picture, see What is incident response?.

Why sign before you need it

Without a contract, a company under attack must find an available provider, explain its environment, agree terms and sign, while the attacker keeps moving. Every lost hour gives them time to spread across the network or encrypt more servers.

A retainer settles all of this in calm conditions. The provider already knows the context, the contacts and how to get access. NIST’s reference guidance on incident response (SP 800-61, Revision 3, April 2025) puts preparation at the heart of incident response: roles, contacts and resources are defined before an incident, not during one.

What a retainer contains

Clause	What it specifies
On-call cover	How to reach the team (phone, portal) and when, ideally 24/7
Response time	Maximum time between your call and the start of work, remote then on site
Scope	Systems and sites covered, incident types included
Services	Triage, containment, investigation, eradication, recovery support, report
Billing	Fixed fee, prepaid hours, or response included in a wider service
Preparation	Information to provide, tools to deploy, contacts, optional exercise
Coordination	Who decides, who talks to authorities, how the MSP is involved

For the services themselves, see What does incident response cover?.

The main models

Prepaid hours. The company buys a block of response hours. They are used when an incident occurs; depending on the contract, leftover hours can be converted into preparation work or expire.

Availability only. The company pays for a contractual response time, and the actual response is billed on top when it happens.

Response included in a managed service. Some managed SOCs build a CERT and incident response into their offer. The client has no second contract to manage, and the responders already know the environment from day-to-day monitoring.

What drives the cost

Without quoting prices, these are the factors that shape a retainer:

• the size and complexity of the IT estate (endpoints, servers, sites, cloud environments);
• the contractual response time and the on-call window;
• the number of hours included, and what happens to unused ones;
• on-site work and travel;
• collection and investigation tools already in place, which cut start-up time;
• any requirement for a qualified provider, such as ANSSI’s PRIS scheme in France. See What is a PRIS qualified incident response provider?.

Questions to ask before signing

1. What is the real response time at night and at weekends?
2. Who responds: an in-house team or subcontractors?
3. Which tools should be deployed in advance to save time?
4. How is the MSP involved in decisions and actions?
5. Is the incident report included, and how soon is it delivered?
6. Does the contract cover support with notifications (data protection authority, regulators) and the police report?

How Cyna does it

At Cyna, incident response is handled by its CERT, a member of InterCERT France, alongside the managed SOC. It works with the SOC teams and can be mobilised quickly; when the client is already monitored, the responders know the environment from day-to-day monitoring. Cyna’s incident response on-call team is available 24/7 from the Report an incident page. Cyna’s certifications and security documents are available on its Trust Center. See What is included in a managed SOC? and How to assess a SOC provider’s incident response.

Talk to an expert

Want to prepare incident response for your organisation or your clients? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Is an incident response retainer mandatory?

No law requires one. Article 21 of NIS2 lists incident handling among the risk management measures expected of entities in scope, and a retainer is a straightforward way to make them work in practice. See Is incident response mandatory?.

What happens to unused prepaid hours?

It depends on the contract. Some let you reallocate unused hours to preparation work, such as a tabletop exercise or a configuration review; others let them expire at the end of the term. Clarify this before signing.

Does cyber insurance replace a retainer?

Not always. A policy covers certain costs, sometimes through a provider chosen by the insurer. It does not necessarily provide a team that already knows your environment. Check how the two fit together, with your broker or legal adviser if needed.

Can we call a provider without a retainer?

Yes, but you will have to find someone available, scope the work and sign a contract under pressure. See Can you hire an incident response provider without a contract?.