Question 1

What is an incident response retainer service?

Accepted Answer

An incident response retainer provides organizations with a structured form of expertise and support through a security partner, enabling them to respond quickly and effectively in the event of a cyber incident. Having an incident response retainer in place allows you to benefit from proactive support with protecting your operations, reputation and bottom line. Timely response and notification for cyber incidents is mandated by many privacy and consumer protection laws. Having a retainer in place also reduces the challenges of identifying expert support in the event of a major event which affects many organizations at the same time.

Question 2

What is included in an incident response retainer?

Accepted Answer

The specific nature and structure of an incident response retainer will vary according to the provider and your organization’s requirements. This is why it is essential to take time to assess which provider to work with. A good incident response retainer should be robust but flexible, providing proven support through specialists to successfully contain and remediate an incident. The retainer should include a wide range of services and be configurable to your needs and environment, regardless of the technologies you use. A good retainer will ensure rapid response services to provide peace of mind in the event of an emergency.

Question 3

How can an incident response retainer help your organization?

Accepted Answer

An incident response retainer offers some key advantages in helping to enhance your organization’s cybersecurity. It allows organizations to become better prepared so that they can act fast in the event of a cyber incident. A cyber incident retainer helps companies to manage their cybersecurity costs more effectively as it offers a structured way for them to pay, ensuring that they gain the best value for money from their budget. Having a retainer in place also means that organizations benefit from fast response and expert advice as and when they need it.

Question 4

What is the first step to organizing an incident response retainer service?

Accepted Answer

A key first step in organizing an incident response retainer service is to identify a high quality security partner. Assess the company’s security experience and approach and what they offer through the retainer. Check that the company’s services are flexible and responsive, with the breadth to support your organizations in different locations. When considering a retained incident response service, you should also consider aspects such as payment options, if there are any minimum hourly usage requirements and whether the company’s services are technology-agnostic so that they can align with your security stack.

Question 5

How does an incident response retainer work?

Accepted Answer

An incident response retainer works by setting clear parameters and expectations for the provision of services relating to incident response. As well as specific actions around dealing with an incident, the retainer can also include more strategic support to help enhance an organization’s long-term planning. It is important to be aware that the quality and scope of support varies widely between providers. At Kroll, we offer more than a typical incident response retainer, providing a combination of elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Question 6

What should be considered when choosing a retained incident response service?

Accepted Answer

It is essential to consider a number of key elements when choosing a retained incident response service. Look at whether the provider offers the level of scope of services you require, from proactive incident response to more strategic advice and support. You should also assess the provider’s capacity to offer 24/7 support in a wide range of locations, depending on your needs, and the breadth of the provider’s technical expertise. Another key aspect to consider is the speed and flexibility with which a provider is able to support you in the event of a security incident.

Question 7

What are the different types of cyber incident response retainers?

Accepted Answer

An incident response retainer works by providing a structured agreement between an organization and a security services provider. One type of option is a no-cost retainer in which a service provider outlines how they will help the organization respond to an incident, in the event of one occurring. Another type is a prepaid retainer where the organization pays in advance for an agreed number of hours, which can be used to respond to cyber incidents. At Kroll, we provide incident response retainers that allow companies to achieve the greatest impact with highest level of flexibility.

Question 8

How can incident response retainers enhance security?

Accepted Answer

Preparing for and dealing with a cyber incident is fraught with unknowns and potential risks. Having assured support in place allows organizations to respond more effectively to cyber security incidents with the right external support and expertise on hand as and when it’s required, instead of having to search for it when an incident does take place. An incident response incident retainer can include more strategic support with planning and strategy which can significantly enhance security and provide peace of mind. A Kroll incident response retainer guarantees expedited response as well as high quality notification and proactive services.

Vendors	Digital Forensics	Incident Response	Breach Notification	Testing & Assessments	Tabletop Exercises	Litigation Support
Kroll
Others

	Premier	Plus
Response Time Service Levels	Incident support contact within two hours (24/7/365)	Incident support contact within four hours (24/7/365)
Service Credits Application	100% of retainer credits can be applied towards any cyber risk consulting service
Rollover Credits	Up to 20% of unused services credit may be applied to the following year upon renewal
Rate Discount	15% discount on any additional hourly-based proactive or incident response cyber risk service	10% discount on any additional hourly-based proactive or incident response cyber risk service

Cyber Risk Retainer

Explore Cyber and Data Resilience

Customizable Incident Response Retainer

How Flexible is the Cyber Risk Retainer?

Client Testimonials

Incident Response Retainer Service Features

Choose the Incident Response Retainer Option That Fits Your Organization’s Posture and Need

Customize Your Incident Response Retainer for Optimal Coverage

Peace of Mind and Expert Support Just a Call Away

Talk to a Cyber Expert

The State of Cyber Defense: Manufacturing Cyber Resilience

The State of Cyber Defense: Manufacturing Cyber Resilience

Frequently Asked Questions

Connect With Us

Data Collection and Preservation

Computer Forensics

24x7 Incident Response

Office 365 Security, Forensics and Incident Response

Malware Analysis and Reverse Engineering

Malware and Advanced Persistent Threat Detection

Business Email Compromise (BEC) Response and Investigation

Digital Forensics Services

Mobile Device Forensics

Enabling an Investor Services Firm to Prepare for DORA Compliance

Q4 2024 Cyber Threat Landscape: Gone Phishing. Evolving Techniques Keep Organizations on the Hook

January Threat Intelligence Spotlight Report

Cyber Threat Hunting Explained: Advanced Techniques, Tools, and Intelligence

Kroll Appoints Katherine Keefe to Lead Global Cyber Insurance Industry Capabilities

Kroll Becomes Relativity Gold Provider Partner

Kroll Recognized in 2024 Gartner Market Guide for Digital Forensics and Incident Response Retainer Services for the Fifth Consecutive Year

Kroll Expands AI Risk Consulting Services

Join Kroll at CLOC 2025 in Las Vegas

Webinar - How to Adopt DORA’s Threat Led Penetration Testing Requirements

Kroll at RSAC 2025 Conference

Kroll at Infosecurity Europe 2025

Kroll is headquartered in New York with offices around the world.

	“As a Cyber Risk Retainer client, we have appreciated Kroll’s expedited response for potentially critical issues. Their subject matter expertise allowed us to contain a situation prior to it developing into a significant issue.” – Option Care Health
	“Kroll's Cyber Risk Retainer program gave us the flexibility to utilize our retainer credits to help us accomplish some of our IT security goals during the year, while having the peace of mind that we had a Tier 1 partner to quickly respond if we had some type of cyber incident.” – Netscout Systems, Inc