Can you hire an incident response provider without a contract in place?

On the market, it is generally possible to hire an incident response provider without a contract in place: many take on emergency engagements. But before they act, an engagement agreement is signed (scope, authorisations, confidentiality, fees), access is granted and the provider is walked through the environment. That start-up time is the real cost of having no contract, and it is paid while the attack is still running. An organisation under attack can contact Cyna’s on-call team, available 24/7, from the Report an incident page.

This article is part of our series on how incident response unfolds. For the full picture, see How does incident response work?.

What happens when you call without a contract

An organisation discovers an attack and has no designated provider. The sequence usually looks like this:

1. Find an available provider: searching, calling, sometimes being turned away for lack of capacity.
2. Scope the request: the provider assesses the situation by phone to estimate the effort.
3. Contract: proposal, engagement agreement, internal approval, signature.
4. Grant access: accounts, remote access, deployment of collection tools.
5. Learn the environment: architecture, contacts, backups, security tools in place.
6. Start the investigation.

With a contract in place, steps 1 to 5 are largely settled before the crisis. Without one, they happen under pressure, while the attack spreads or the business is at a standstill.

Why you cannot skip the agreement

Even in an emergency, a reputable provider will not start without written terms. This is not red tape: investigating means accessing your systems, copying logs and sometimes sensitive data. That calls for explicit authorisation from whoever is responsible for the systems, a clear scope, confidentiality commitments and rules on preserving evidence.

In France, ANSSI’s PRIS framework for qualified incident response providers (version 3.2, October 2025) sets specific requirements on the relationship with the client and the protection of information collected. A provider offering to dive in with nothing in writing is a warning sign.

How to choose well in an emergency

What to check	Why it matters
Real availability	Who can start now, remotely and on site if needed
Qualification or label	National schemes where they exist, such as PRIS (ANSSI) or ExpertCyber (Cybermalveillance.gouv.fr) in France
Scope of the agreement	Investigation only, or also coordination, crisis management and remediation support
Cyber insurance policy	Claims procedure and any assistance service provided by the insurer
Evidence handling	Collection methods that hold up for a police report and the insurer’s assessment
Points of contact	Who decides and signs for you, who coordinates for the provider

In France, the 17Cyber service, launched at the end of 2024 by Cybermalveillance.gouv.fr and the Ministry of the Interior, directs organisations, depending on the situation, to a regional CSIRT, to labelled providers or to filing a police report. Other countries have their own national reporting points. The full list of who to call is covered in Who to contact after a cyberattack.

Obligations do not wait for a signature

For entities subject to NIS2, Article 23 provides for an early warning within 24 hours of becoming aware of a significant incident, and an incident notification within 72 hours. If personal data is affected, Article 33 of the GDPR provides for notification to the supervisory authority within 72 hours of becoming aware of the breach. Those clocks keep running while you look for a provider and negotiate terms.

Preparing before an incident

Three options take the race against the clock out of the equation:

• An incident response retainer signed in calm conditions, with engagement terms known in advance. See What is an incident response retainer?.
• A managed SOC whose contract covers incident response: access, tools and knowledge of the environment are already in place on the day of the attack.
• An up-to-date quick-reference sheet: who to call, who signs, where the backups are, the insurer’s helpline number.

Cyna’s CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page, including for an organisation that is under attack right now. To compare with a fully in-house approach, see Do you need an external incident response provider, or is your in-house team enough?.

Talk to an expert

Want to know who to call, and on what terms, the day a client is attacked? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

How long does it take to get started without a contract?

It depends on the provider's availability and how quickly the client can sign. There is no standard delay. Most of the lost time goes on contracting and on learning your environment, both of which a prior contract settles in advance.

Can my insurer require a specific provider?

Some cyber insurance policies include an assistance service or a claims procedure. What your policy provides is set out in the contract and can be checked with your insurer, ideally at the start of the incident, before committing to costs.

How do you vet an unknown provider in the middle of a crisis?

Check for any national qualification or label (in France, ANSSI's PRIS qualification or the ExpertCyber label), ask who will actually do the work and with what experience, and have the agreement reviewed by your adviser if possible. See PRIS incident response providers in France.

Can my MSP sign on my behalf?

It can organise the engagement, but authority to access and investigate your systems normally comes from your organisation. It helps to decide in advance who signs if the managing director is unavailable.