What does an incident response service cover?

An incident response service covers triaging the incident, containing the attack, investigating what happened, removing the attacker and supporting the restart of operations. It ends with a report. Depending on the offer, it may also include help with regulatory notifications and support for the crisis team. Full rebuilds and legal matters are usually out of scope.

This article is part of our incident response series. For the full picture, see What is incident response?.

The building blocks

1. Intake and triage

The responder gathers the first facts: what was seen, since when, which systems seem affected. They confirm that it really is an incident, assess its severity and set initial priorities. See What is a cybersecurity incident?.

2. Containment

The aim is to stop the attack spreading: isolating endpoints or servers through the EDR, disabling accounts, blocking network traffic, cutting off remote access. This is done while preserving evidence, and in agreement with the client and its MSP, because each step affects operations.

3. Investigation

This is the detective work: hunting for indicators of compromise, analysing logs, forensic examination of affected machines, analysing any malware found. It answers four questions: how the attacker got in, what they did, what they may have taken, and whether they are still there.

4. Eradication

Once the attack is understood, everything the attacker left behind must go: accounts they created, backdoors, scheduled tasks, remote access tools. Resetting passwords without finding their fallback access simply lets them back in. See How do you know the attacker is gone?.

5. Recovery support

The responder advises which systems can restart, in what order and under what monitoring. The actual return to service is often carried out by the MSP. See Does incident response include data recovery?.

6. Reporting

The report sets out the timeline, the entry point, the extent of the compromise, the actions taken and recommendations. It serves management, the insurer, the authorities and, where relevant, the courts. See What goes into an incident report?.

Included, optional or out of scope

Item	Usual position
Triage, containment, investigation, eradication	Core service
Incident report	Usually included, level of detail varies
Facts for regulatory notifications (NIS2, GDPR)	Often included; the business still files the notification
Crisis team support	Depends on the offer; a separate activity in the French PRIS framework since October 2025
On-site intervention	Often optional
Full rebuild of the IT estate	More of a remediation project, often led by the MSP
Data restoration	Depends on the contract and on available backups
Legal advice, dealings with the insurer	Lawyer, broker
Public communications	Senior management, possibly a specialist agency

ANSSI, France’s national cybersecurity agency, draws the same line in its “Cyberattacks and remediation” guide series, treating remediation as a project in its own right, separate from incident handling. NIST, in Revision 3 of SP 800-61 (April 2025), frames incident response as part of overall risk management rather than a one-off intervention.

Three engagement models

1. On demand: you call a provider when the attack hits. The contract must then be agreed, access opened and tools deployed, which costs hours. See Can you use an incident response provider without a contract?.
2. Retainer: the terms, response times and access are agreed before any incident.
3. Included in a managed SOC: the team that monitors the estate already knows it and moves straight from detection to response. This is Cyna’s model: Cyna’s CERT, a member of InterCERT France, works alongside the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page.

What to check in the contract

• The planned mobilisation time, day and night.
• What is done remotely and what justifies a site visit.
• The tools the responder relies on (EDR, logs, console access).
• How roles are split with the MSP: who isolates, who restores, who signs off.
• What the report contains and when it is delivered.
• How evidence is retained and kept confidential.

For more on choosing a responder, see What is a PRIS-qualified incident response provider?.

Talk to an expert

Want to check what your current set-up covers, or your clients’? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Is incident response delivered remotely or on site?

Mostly remotely, using the EDR and logs already in place, which allows fast action. An on-site visit can help with isolated systems or a heavy crisis component. Check what your contract says.

Does the responder negotiate with ransomware attackers?

That is not the core of an incident response service. France's Cybermalveillance.gouv.fr advises against paying the ransom, as there is no guarantee the data will be recovered. The decision rests with senior management, together with their lawyer and insurer.

How much does incident response cost?

Price depends on the engagement model (on demand, retainer or included in a managed SOC), the size of the estate, how long the engagement lasts and whether on-site work is needed. Emergency engagements with no prior contract are usually the most expensive. See What is an incident response retainer?.

Do tools need to be in place for the service to work?

It helps a great deal. A deployed EDR and retained logs let responders act fast and reconstruct the attack. Without them, the responder must first install tooling, which delays containment. See Do you need an EDR for a managed SOC?.