During an incident, hours go on finding help and agreeing terms. A retainer settles the contract, access and contacts in advance and puts experienced responders on your side from the first call.
Unused hours are put to work on readiness: playbooks, tabletop exercises and log-readiness reviews that shorten the next incident.
Why it matters
Guaranteed response times
Remote and on-site investigation
Forensic evidence handling for legal use
Regulator and authority notification support
Unused hours converted to readiness work
Who delivers each serviceSome managed services are delivered by a vetted delivery partner rather than by CISO Consulting's own team. Each service states who delivers it, and the proposal confirms the delivering party and the contract before you commit. Explore managed security
How the engagement runs
- 1OnboardContacts, access, tooling and playbooks
- 2PrepareExercises and readiness reviews
- 3RespondTriage, contain, investigate, recover
- 4LearnReport, lessons and improvements
What you receive
- Retainer agreement with contact tree
- Incident playbooks
- Incident and forensic report when activated
- Annual readiness exercise
Packages
| Essential | AdvancedRecommended | Enterprise | |
|---|---|---|---|
| Response time | Next business day | Four hours | One hour |
| Coverage | Remote | Remote and on-site | Remote, on-site and forensic lab |
| Readiness work | Playbook review | Playbooks and one exercise | Playbooks and two exercises |
| Regulator notification support | Guidance | Included | Included with legal liaison |
| Review | Yearly | Twice a year | Quarterly |
The exact scope and targets are confirmed in your proposal.
Questions
What counts as an activation?
Any suspected incident you report. Triage starts within the response time of your tier.
Can unused hours roll over?
Unused hours are applied to readiness activities during the term, as set out in the agreement.