Incident response retainer RFPs usually ask whether a provider offers "24/7 response" and "forensics", every bidder says yes, and the differences in clock definitions, expiring hours, insurer acceptance and identity skills only surface during a real incident. This template gives you a ready-to-issue request for proposal for an incident response (IR) retainer, with numbered requirements that can be verified and scored. It covers response times, retained hours, forensic and investigation scope, insurer panel status, working under legal counsel, responder access to your estate, evidence handling, commercials, weighted scoring and a pre-award test plan. It is vendor-neutral and written for CISOs, security operations leads, procurement and legal teams. For how the market works and what to look for, read the Incident Response Retainer Buyer's Guide first; this page is the procurement document.
How to use this template
- Replace text in square brackets, such as [Organisation], [insurer] and [number], with your own details. Delete requirements that do not apply rather than leaving them unscored.
- Each requirement has an ID (for example IRR-SLA-02) and a type: M mandatory (pass or fail; a fail eliminates the bid), S scored (weighted 0 to 5) or I informational (not scored). Keep M items few.
- Times, hours and weights in brackets are illustrative, not benchmarks. Set them from your incident response plan, insurance policy and risk appetite before issue, and do not change them after responses arrive.
- Agree sections 4.4 (legal counsel) and 7 (commercials) with your legal team and your cyber insurer before issue.
- Issue sections 1 to 8 to bidders. Implementation guidance is for the evaluation panel only. Ask for responses in a spreadsheet with one row per requirement ID.
1. Purpose and scope
[Organisation] invites proposals for a [one / two / three]-year incident response retainer providing emergency response, digital forensics and investigation, containment and recovery support, and proactive readiness services.
- In scope: 24/7 incident hotline; remote and on-site response in [countries]; investigation of endpoints, servers, cloud platforms [names], SaaS [names] and identity providers [names]; malware analysis; containment and eradication support; reporting suitable for executives, regulators and insurers; proactive services funded from retained hours.
- Out of scope: [24/7 monitoring, provided by our MDR provider]; [legal advice]; [public relations]; [ransom negotiation, unless separately approved].
- Drivers: [insurance policy requirement]; [regulatory obligations, such as sector regulator or breach notification deadlines]; [lessons from previous incidents]; [board risk appetite].
2. Organisation background
| Item | [Organisation] value |
|---|---|
| Locations and countries where response may be needed | [list] |
| Endpoints and servers | [number] endpoints, [number] servers, [operating systems] |
| Cloud and SaaS | [cloud providers, number of accounts or subscriptions]; [key SaaS platforms] |
| Identity | [directory and identity provider]; approximate number of service accounts, API keys and AI agents [number or "unknown"] |
| Security tooling | [EDR], [SIEM], [MDR provider], log retention of [period] |
| Operational technology | [none / sites and systems] |
| Cyber insurance | [insurer], panel requirement [yes / no], hourly rate limit [amount] |
| Regulators and notification duties | [for example data protection authority, sector regulator, securities regulator] |
3. Instructions to bidders
- Timeline: RFP issued [date]; questions by [date]; answers shared with all bidders [date]; responses due [date, time, time zone]; shortlist tests [dates]; award [date].
- Contact: [name, email]. Other contact with [Organisation] staff about this RFP may lead to disqualification.
- Response scale: for each requirement state included, included with conditions (state them), chargeable extra, subcontracted (name the subcontractor) or not offered.
- Evidence: attach a redacted sample report, SLA performance data for the last [12] months and accreditation certificates for the contracting legal entity.
4. Requirements
4.1 Response times and service levels
| ID | Requirement | Type |
|---|---|---|
| IRR-SLA-01 | 24/7/365 hotline answered by a person, with a qualified responder call-back within [1] hour of first contact. | M |
| IRR-SLA-02 | Define precisely which event starts and which event stops each SLA clock (first contact, call-back, remote engagement, on-site arrival). Clocks starting at contract signature or end of triage are not acceptable. | M |
| IRR-SLA-03 | Remote engagement (analysts working on our data) within [4] hours; on-site arrival in [locations] within [24 / 48] hours where requested. | S |
| IRR-SLA-04 | Service credits or fee reductions for missed SLAs; provide the last [12] months of SLA performance. | S |
| IRR-SLA-05 | Describe surge capacity and how you prioritise retainer clients during widespread events affecting many clients at once. | S |
4.2 Retained hours
| ID | Requirement | Type |
|---|---|---|
| IRR-HRS-01 | State the retained hours included per year ([number]) and the rate card for hours beyond them, by role. | M |
| IRR-HRS-02 | Unused hours roll over or convert to proactive services (tabletop exercises, plan review, compromise assessment, readiness assessment). State conversion rates and deadlines. | S |
| IRR-HRS-03 | Monthly statement of hours used, remaining and expiring. | S |
| IRR-HRS-04 | Confirm whether a zero-hour (on-call only) option is available, and its rates. | I |
4.3 Investigation and forensics scope
| ID | Requirement | Type |
|---|---|---|
| IRR-FOR-01 | Forensic acquisition and analysis of endpoints, servers, memory and network data, with documented chain of custody and evidence integrity verification. | M |
| IRR-FOR-02 | Investigation in [cloud platforms] and [SaaS platforms] using control plane and audit logs; name staff experience in each. | M |
| IRR-FOR-03 | Identity compromise response: identity provider and directory investigation, token and session revocation, and bulk rotation of service account credentials, API keys and OAuth grants. | S |
| IRR-FOR-04 | Malware analysis in house; state what is subcontracted. | S |
| IRR-FOR-05 | Ransomware and extortion support, including how legal and sanctions checks are coordinated through counsel. | S |
| IRR-FOR-06 | Operational technology incident capability at [sites], with named experience. State whether any independent assurance covers it. | [S or delete] |
| IRR-FOR-07 | Deployment of your own EDR or collection tooling if needed: licensing, privileges, data flows and removal at the end of the engagement. | S |
See the Identity Incident Response Playbook for the identity scenarios IRR-FOR-03 should test.
4.4 Assurance, insurer and legal counsel
| ID | Requirement | Type |
|---|---|---|
| IRR-ASR-01 | [UK buyers] Current NCSC Cyber Incident Response (CIR) scheme assurance for the contracting entity at [Enhanced / Standard] level, with work carried out under the scheme's terms and conditions. | [M] |
| IRR-ASR-02 | Other independent accreditation for incident response (for example CREST) held by the contracting entity, and individual certifications of the proposed team. | S |
| IRR-INS-01 | Confirm whether you are on [insurer]'s incident response panel. If not, state whether you will obtain the insurer's written approval before contract start, and confirm your rates fall within the policy limit of [amount]. | M |
| IRR-INS-02 | Describe how you coordinate with insurers and breach counsel at the start of an incident, including notification steps the policy requires. | S |
| IRR-LEG-01 | Confirm you can be engaged by [Organisation]'s external counsel and work under counsel's instruction, and describe how reports, drafts and findings are structured and shared in that model. | S |
| IRR-LEG-02 | Describe how you support regulatory notifications and law enforcement liaison, without providing legal advice. | S |
The NCSC lists incidents involving external legal counsel, regulated-sector and multinational incidents among the experience required only at Enhanced level, and strongly recommends Enhanced providers for organisations that are regulated, operate in more than one country, are part of Critical National Infrastructure or UK central government, or are likely nation-state targets.
4.5 Responder access, evidence and data protection
| ID | Requirement | Type |
|---|---|---|
| IRR-SEC-01 | Responders access [Organisation] systems only through named, individual accounts issued by us, with phishing-resistant MFA, least privilege and time limits; no shared accounts. | M |
| IRR-SEC-02 | All responder credentials, API tokens and tooling keys issued during an engagement are listed in the closure report and revoked at closure. | M |
| IRR-SEC-03 | Evidence stored encrypted in [regions], segregated per client, with access logging; state retention and destruction terms and provide certificates of destruction. | M |
| IRR-SEC-04 | Provide a current independent security assurance report for your own operations and list sub-processors and their locations. | S |
| IRR-SEC-05 | Staff vetting levels and how [Organisation] can verify any security clearances required. | [S or I] |
Prepare these accounts in advance with the same controls as other emergency access; see the Break-Glass Account Guide.
4.6 Reporting and onboarding
| ID | Requirement | Type |
|---|---|---|
| IRR-REP-01 | Daily situation reports during an active incident; final report with timeline, root cause, scope of data accessed, actions taken and recommendations. | M |
| IRR-REP-02 | Onboarding within [30] days of award: contacts, escalation tree, network and log source inventory, pre-approved tooling, data processing terms. | S |
| IRR-REP-03 | At least one joint tabletop exercise per year using a scenario we choose. | S |
5. Team and references
- Named lead: the incident lead and deputy who would normally be assigned, with incident experience in our sector.
- Bench depth: number of responders in each region and how many are employees rather than contractors.
- Subcontractors: every subcontractor who may handle our data, and what they do.
- References: [two or three] clients of similar size or sector who have used the retainer in a live incident.
6. Contract terms
- Term and exit: [term], termination for convenience with [notice], and return or destruction of evidence at exit.
- Liability and insurance: the provider's professional indemnity and cyber cover levels.
- Conflicts: how conflicts are handled if the provider is retained by another party to the same incident.
- Confidentiality: restrictions on naming [Organisation] or publishing threat intelligence derived from our incident.
7. Commercials
| Cost element | What to state |
|---|---|
| Retainer fee | Annual fee and hours included |
| Rate card | Hourly or daily rates by role, standard and out of hours |
| Expenses and travel | Basis and caps |
| Tooling | EDR or collection tool charges during an incident |
| Proactive services | Hours each service consumes |
| Renewal | Cap on price increases |
8. Evaluation method and pre-award tests
[Organisation] will check mandatory requirements, then score the rest using these weights (illustrative; set your own before issue):
| Criterion | Weight | Evidence |
|---|---|---|
| Response times and surge (4.1) | [20%] | SLA definitions, performance data, hotline test |
| Investigation capability (4.3) | [25%] | Sample report, team experience, tabletop |
| Assurance, insurer and legal fit (4.4) | [15%] | Certificates, insurer confirmation |
| Access and evidence security (4.5) | [10%] | Assurance report, procedures |
| Team and references (5) | [10%] | Reference calls |
| Cost over the term, including hour flexibility (4.2, 7) | [20%] | Pricing schedule modelled on [two] incidents a year |
Scores use 0 to 5: 0 not offered; 1 offered with significant conditions; 3 meets the requirement; 5 exceeds it and is evidenced. Shortlisted bidders will complete these tests:
- An unannounced hotline call at an agreed window, measuring time to a qualified responder.
- A two-hour scenario walk-through with the proposed lead (for example identity provider compromise, or ransomware with data theft), including insurer and counsel steps.
- Review of a redacted final report from a comparable engagement.
- A demonstration of evidence collection from a test endpoint and a test cloud tenant, using time-limited accounts we issue and revoke afterwards.
Implementation guidance
This section is for the evaluation panel, not for bidders.
- Start with the insurer: confirm the panel list, consent process and rate limits before drafting IRR-INS-01; it often removes bidders before scoring starts.
- Model real cost: price two realistic incidents and one quiet year for each bid, including expiring hours. The cheapest retainer fee is often the most expensive outcome.
- Agree the legal model early: decide with counsel whether counsel will engage the provider, and make sure the contract structure matches that decision.
- Use the right assurance level: in the UK, apply the NCSC criteria for Enhanced level to decide whether IRR-ASR-01 requires Enhanced. The NCSC is not party to your contract, so do your own due diligence on sector experience.
- Prepare access now: create the responder accounts IRR-SEC-01 describes in a disabled state, so enabling them is a change, not a project, during an incident.
- Carry IDs into the contract: make each scored answer a contractual commitment and test the hotline again in the first quarter.
| Requirement group | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| External response support (4.1 to 4.3) | IR-4, IR-7, IR-7(2) | RS.MA-01, RS.AN-03 |
| Supplier inclusion in planning and tests (4.6, 8) | IR-3, IR-8 | GV.SC-08 |
| Contract requirements and supplier assessment (4.4, 4.5, 6) | SA-4, SR-6 | GV.SC-05 |
| Evidence retention (4.5) | AU-11 | RS.AN-03 |
NIST SP 800-61 Rev. 3 (April 2025) frames incident response as part of cyber risk management under CSF 2.0; use it to check that the retainer fits your plan rather than replacing it. See the Incident Response Guide and the Incident Response Plan Template.
Standards and references
- NCSC: Cyber Incident Response scheme
- NCSC: Cyber Incident Response, information for buyers
- NIST: SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST: SP 800-86 Guide to Integrating Forensic Techniques into Incident Response
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Incident Response Retainer Buyer's Guide · Incident Response Guide · Cyber Insurance Guide · Security Vendor Evaluation and RFP Guide · SIEM RFP Template