An incident response retainer is bought in calm conditions but judged in the worst week of the year, and many organisations only discover its limits once they need it. Response times turn out to start from a triage call rather than from arrival, pre-paid hours expire unused, the cyber insurer will not pay for the chosen firm, or the provider lacks the cloud or identity skills the incident demands. This vendor-neutral buyer's guide helps you define what you need from a retainer, compare providers on capability and terms, check accreditations such as the NCSC Cyber Incident Response (CIR) scheme and CREST, and test the relationship before a real incident. It is for CISOs, security operations leads, procurement and risk teams buying or renewing incident response (IR) services.
Key takeaways
- Align with your insurer first. Most cyber policies route incidents to a panel of pre-approved responders, and using a non-panel firm usually needs the insurer's prior written consent.
- Assurance schemes set a floor, not a guarantee. The NCSC CIR scheme and CREST accreditation show a provider has been independently assessed, but the NCSC says membership is not a guarantee of being risk free and buyers must do their own due diligence.
- Read the SLA definitions, not the headline. Ask exactly what starts and stops the clock, and what "on site" and "remote engagement" mean.
- Make unused hours work. Prefer retainers that let pre-paid hours convert to proactive services such as tabletop exercises, readiness assessments or compromise assessments.
- Onboard before you need it. Contracts signed, data-sharing terms agreed, tooling pre-approved and contacts exchanged can save days at the start of a real incident.
Define requirements
Start from your incident response plan and threat model, not from provider brochures. NIST SP 800-61 Rev. 3, published in April 2025 as a CSF 2.0 Community Profile, treats incident response as part of wider cyber risk management, and CSF 2.0 outcome RS.MA-01 expects the response plan to be executed in coordination with relevant third parties. Document:
- Likely scenarios: ransomware, business email compromise, cloud account takeover, identity provider compromise, insider data theft, OT disruption.
- Estate: on-premises, cloud platforms, SaaS, identity providers, OT, and the countries you operate in.
- Constraints: regulatory notification deadlines, sector regulators, data that cannot leave a jurisdiction, and whether staff need security clearance.
- Insurance: your policy's panel, consent requirements, hourly rate limits and notification duties. See the Cyber Insurance Guide.
- Internal capacity: what your own team or MDR provider will handle and where the retainer takes over. See the MDR Buyer's Guide.
- Legal model: whether external counsel will engage the IR firm, which affects how reports are commissioned and shared.
Smaller organisations often do best with a modest retainer from an insurer panel firm that holds the relevant UK assurance. Larger, multinational or regulated organisations may need two providers, or one with global coverage, and should test cross-border logistics explicitly.
Capability areas
| Capability area | What it covers | What to check |
|---|---|---|
| Triage and incident management | 24/7 hotline, scoping, incident commander support, stakeholder briefings | Who answers the hotline; seniority of the lead assigned |
| Digital forensics | Endpoint, server, memory, network and log analysis with evidence handling | Chain of custody procedures; forensic tooling; report standards |
| Cloud and SaaS investigation | Control plane logs, tenant audit logs, workload and container forensics | Named experience in your cloud and SaaS platforms |
| Identity compromise response | Identity provider, directory, OAuth app and service account investigation; credential reset and token revocation at scale | Experience rebuilding directory trust and revoking non-human credentials |
| Malware analysis and threat intelligence | Reverse engineering, indicator extraction, threat actor context | Whether analysis is in-house or subcontracted |
| Containment and recovery support | EDR deployment, eradication, restoration planning | Whether they bring their own EDR or use yours |
| Ransomware and extortion support | Threat actor communication support, sanctions and legal coordination via counsel | Processes for legal and sanctions checks |
| Proactive services | Tabletop exercises, IR plan review, readiness and compromise assessments | Whether unused hours can be redeemed for these |
The NCSC CIR scheme defines two assurance levels. The NCSC Assured CIR Buyer's Guide (March 2025) says both levels cover cybercriminal incidents, basic malware analysis, log analysis on smaller estates, network traffic inspection and digital forensics. Only Enhanced level covers advanced persistent threat response, regulated-sector and multinational incidents, work involving law enforcement or external legal counsel, threat intelligence, advanced malware analysis, endpoint detection and log analysis on larger estates. The NCSC strongly recommends Enhanced for organisations in regulated sectors, operating in more than one country, likely to be targeted by nation-state attackers, in Critical National Infrastructure or in UK central government. Standard level, delivered on the NCSC's behalf by CREST and IASME, suits smaller and UK-only organisations outside those criteria. The NCSC notes it has not assessed any provider's OT or industrial control system capability, so verify that independently. See the OT Incident Response Guide.
Evaluation criteria
| Criterion | Good answer | Weak answer |
|---|---|---|
| Assurance | Current NCSC CIR listing at the right level (UK) or CREST incident response accreditation; staff with individual certifications such as CREST Certified Incident Manager (CCIM) | Accreditation held by a parent company or another region only |
| Response SLA | Defined times for hotline answer, qualified responder call-back, remote engagement and on-site arrival, with service credits | "Rapid response" with no defined clock |
| Pre-paid hours | Hours roll over or convert to proactive services; clear rate card for overage | Hours expire at year end; overage at higher emergency rates |
| Insurer alignment | On your insurer's panel, or pre-approved in writing, at rates within the policy's limits | Not on the panel and no plan for consent |
| Staffing and surge | Named lead, documented bench depth, subcontractors disclosed | Undisclosed subcontracting at peak demand |
| Coverage | Responders and legal ability to work in all your jurisdictions | Travel-dependent coverage for key countries |
| Reporting | Sample report shared; structure supports regulators, insurers and root cause analysis | No sample available |
| Provider security | Secure evidence storage, segregated client data, MFA and least privilege for responder access to your estate | Evidence on personal devices or shared drives |
CREST lists accredited member companies on its CREST Marketplace, and the NCSC publishes its assured providers through its "Find an Assured CIR Provider" pages. Confirm current status at contract and at each renewal, since NCSC assurance is reviewed at least every two years. The NCSC also tells buyers to carry out their own financial due diligence and to verify any staff clearances themselves.
Questions to ask vendors
- Exactly what event starts the SLA clock, and what has happened when it stops? Show us your SLA performance for the last year.
- Which named people would lead our engagement, and what is their incident experience in our sector?
- Which parts of an investigation would be subcontracted, and to whom?
- Are you on our insurer's panel? If not, will you obtain written pre-approval before inception, and will your rates stay within the policy's limits?
- What happens to unused hours at the end of the term? Which proactive services can they be used for?
- How do you investigate a compromised identity provider, and how have you handled bulk revocation of service account keys, OAuth grants and API tokens?
- Do you deploy your own EDR during an incident? What licensing, privileges and change approvals does that need from us?
- How do you store and transfer our evidence, where is it held, and when is it destroyed?
- How do you work with external counsel when they engage you, and how are reports structured for that?
- What is your onboarding process, and what do you need from us before an incident?
Red flags
- SLA times measured from the end of a triage call or contract signature rather than from first contact.
- Pre-paid hours that expire with no option to convert them to proactive work.
- Reluctance to name the team lead or disclose subcontractors.
- Accreditation claims that cannot be matched to the NCSC or CREST listings for the contracting entity.
- No sample report, or reports that are mostly tool output.
- A retainer bundled with product purchases where the response team mainly supports one vendor's tools.
- No answer on how responder credentials to your estate are issued, logged and revoked after the engagement.
Proof of concept
A retainer cannot be tested with a real breach, but the relationship can be tested before signature or in the first quarter.
- Hotline test: agree an unannounced test call and measure time to a qualified responder.
- Onboarding run: complete contracts, data processing terms, contact lists, network diagrams and log source inventory, and pre-approve the provider's tooling.
- Joint tabletop exercise: run a scenario relevant to you, such as identity provider compromise or ransomware, with your insurer's notification steps included. See the Tabletop Exercise Guide.
- Evidence collection drill: collect triage data from a sample endpoint and a cloud tenant, and confirm the provider can analyse it and that your log retention is sufficient.
- Access check: issue named, time-limited responder accounts with MFA through your normal process, confirm they work, then disable them until needed.
- Score and record: capture timings, gaps found and actions, and feed them into your Incident Response Plan Template.
Map the relationship to NIST SP 800-53 IR-7 Incident Response Assistance and IR-7(2) Coordination with External Providers, and to CSF 2.0 GV.SC-08, which expects relevant suppliers and third parties to be included in incident planning, response and recovery. Track time to qualified responder, percentage of pre-paid hours used, findings from joint exercises closed, and insurer pre-approval status. See the Incident Response Guide for plans and playbooks.
How NHI Mgmt Group can help
We provide independent market analysis, RFP strategy and evaluation support for identity-related incident readiness and response. Browse vendors in our NHI and AI products directory or contact us about independent evaluation support.
Related NHI Mgmt Group resources: Incident Response Guide · NIST SP 800-61 Incident Response Guide · Cyber Insurance Guide · Security Vendor Evaluation and RFP Guide · Identity Incident Response Playbook