Do You Need an Incident Response Retainer? What It Covers and What to Check Before You Sign
An incident response retainer puts a named team, an agreed response time and a known environment in place before an incident, so the first hours go on containment rather than contracts. Who needs one, what it should include, what the reporting clocks in India and abroad demand, and the questions to ask before you sign.
Security Operations
The worst time to choose an incident response firm is at two in the morning with a ransom note on the screen and a six-hour reporting clock already running. By the time you have found a firm, agreed a contract, explained your network and granted access, the hours the regulator gave you are gone and the attacker has had them too. An incident response retainer exists to move all of that to a quiet afternoon beforehand. Here is who needs one, what it should include, what the reporting clocks in India and abroad demand of it, and the questions to ask before you sign.
In short. A retainer is a standing contract with a named response team: an agreed response time, your environment documented and tooling pre-positioned, pricing settled, and the legal and reporting playbooks written before anything happens. You need one if a regulator gives you hours rather than days to report, if your cyber insurer requires a panel firm, or if you could not say today who would run your response. Judge it on response time, what onboarding actually covers, whether unused time converts to readiness work, how it fits your insurer's panel, and whether the people who answer the phone are the people who will turn up.
The clocks that make the case
Reporting deadlines are the practical reason retainers have moved from nice-to-have to necessary. They are measured in hours, they start before you have the facts, and most organisations answer to more than one.
| Regime | Clock | Starts from |
|---|---|---|
| CERT-In directions, 2022 (India) | Report listed incident types "within 6 hours"; twenty types including ransomware, data breaches and leaks, and attacks on digital payment, cloud, IoT and AI systems | "Noticing such incidents or being brought to notice" |
| RBI directions, 2026 (banks; NBFCs above the smallest tier) | "Within six hours of detection on DAKSH platform", plus proactive notification of CERT-In | Detection |
| SEBI CSCRF | Report by email within 6 hours and through the SEBI incident reporting portal within 24 hours | Occurrence or detection, per the framework's annexure |
| IRDAI | Report to IRDAI and CERT-In within 6 hours | Noticing |
| DPDP Rules, 2025 (from May 2027) | Affected individuals "without delay"; the Data Protection Board without delay, then a detailed report "within seventy-two hours of becoming aware of the breach" | Becoming aware |
| EU and UK GDPR | To the supervisory authority "not later than 72 hours after having become aware of it" | Awareness |
| EU DORA (financial entities) | Initial notification within four hours of classifying a major incident and no later than 24 hours from awareness; intermediate report 72 hours after that; final report within one month | Classification and awareness |
| US SEC (listed companies) | Form 8-K Item 1.05 within four business days | Determining the incident is material |
| Singapore PDPA | Notify the PDPC "no later than three (3) calendar days" | Determining the breach is notifiable |
An Indian NBFC with EU customers can have three clocks running from three different moments. Meeting them is a matter of having the facts quickly, which is what a prepared responder gives you, and of knowing which form goes where, which is what the retainer's playbooks are for. Our guides to CERT-In's six-hour rule and RBI's NBFC directions cover the Indian ones in detail.
What the standards expect you to have arranged
NIST's incident response guidance, SP 800-61 Revision 3 of April 2025, reorganised the old four-phase model around the six functions of the Cybersecurity Framework and is direct about why preparation matters: "Today, incidents occur frequently and cause far more damage. Recovering from them often takes weeks or months." On outside help, it says third parties "may be under contract with an organization to help perform incident response activities", and that "these responsibilities should be clearly defined in a contract, and the incident response team should be aware of the division of responsibilities, including information flows, coordination, and authority to act on behalf of the organization." That sentence is a good definition of what a retainer is for.
ISO/IEC 27001:2022 asks for the same in its Annex A controls 5.24 to 5.28: incident management planning and preparation, assessment of events, response, learning from incidents, and collection of evidence. ISO/IEC 27035 parts 1 to 3 give the detailed process. An auditor will accept a retainer as evidence of preparation; they will not accept a list of firms you might call.
Who needs a retainer
- Anyone with a six-hour clock. Banks, NBFCs, insurers, SEBI-regulated entities and, under CERT-In's directions, essentially every Indian body corporate. You cannot find, contract and brief a firm inside six hours.
- Anyone with cyber insurance. Gartner, as quoted in industry guidance, notes that "cyber insurance policies typically require organizations to have a DFIR retainer". Insurers run panels of approved firms; one major insurer's policy wording says that non-panel providers "must be listed on your cyber policy before the occurrence of any incident", and approval "is not automatic". Using an unapproved firm can mean the cost is not covered.
- Anyone without an in-house response capability. Which is most organisations below a few thousand staff. A SOC detects; responding to a serious intrusion needs forensic, negotiation, legal and communication skills that are not needed often enough to keep in-house.
- Anyone whose vendors hold their data. A vendor breach triggers your reporting duties with none of your evidence; see our guide to third-party cyber risk.
The numbers behind this are not encouraging. Mandiant's M-Trends 2026 puts the global median time an attacker is present before detection at 14 days, up from 11, with only 52% of intrusions detected internally. Sophos's 2026 ransomware survey of 2,158 organisations found that 56% of attacks encrypted data, 48% of those organisations paid, the median payment was $769,000 and the average recovery cost excluding any ransom was $1.7 million. IBM's 2026 study puts the average Indian breach at ₹25.5 crore and reports that 67% of Indian organisations plan to invest more in incident response planning and testing.
What a retainer should include
| Component | What good looks like | What to check |
|---|---|---|
| Response time | A contractual time to first contact with a qualified responder, typically measured in a few hours, and a separate commitment for on-site or remote hands-on work | Whether the time is to a call centre or to an analyst; whether it holds at weekends and on Indian holidays |
| Onboarding | Your network, identity, cloud, logging and key systems documented; contacts and escalation agreed; access arranged in advance; forensic and endpoint tooling pre-positioned or ready to deploy | How many hours onboarding gets, and whether it is refreshed annually |
| Playbooks | Reporting templates and decision trees for every regulator you answer to; a ransomware playbook; an evidence handling procedure | That they name your regulators, not generic ones |
| Commercial model | Either prepaid hours at a fixed rate, or a no-fee retainer that fixes the rate and response time and bills per incident | Whether unused prepaid hours convert to readiness work such as exercises, assessments or testing, or expire |
| Scope of services | Forensics, containment, eradication, recovery support, malware analysis, threat hunting after the incident, and advice on regulator and customer communication | What is excluded; whether negotiation support and crisis communications are in or separate |
| Legal arrangement | Engagement through your counsel where privilege matters; data handling and confidentiality terms; where evidence is stored | Privilege is not guaranteed by structure alone; take legal advice |
| Insurer alignment | The firm is on your insurer's panel or pre-approved in writing; the policy's consent-to-incur and notice provisions are understood | Before signing, not after the incident |
| Exercises | At least one tabletop a year with the retainer team, so the first time you work together is not the real thing | Whether exercises are included or chargeable |
Evidence: the part that cannot be redone
The decisions taken in the first hour decide whether you ever find out what happened, and whether it can be used in a dispute, a claim or a prosecution. CISA's #StopRansomware Guide gives the sequence: disconnect affected systems from the network, and "power down devices if you are unable to disconnect them", with the warning that powering down "will prevent your organization from maintaining ransomware infection artifacts and potential evidence stored in volatile memory". It recommends taking "a system image and memory capture of a sample of affected devices" and preserving evidence "that is highly volatile in nature—or limited in retention—to prevent loss or tampering." It also states that "the authoring organizations do not recommend paying ransom."
In India the admissibility of what you collect now runs through section 63 of the Bharatiya Sakshya Adhiniyam, 2023, in force since 1 July 2024, which replaced section 65B of the Evidence Act. Electronic records need a certificate in the prescribed form, including hash values, from the person in charge of the system and an expert. A retainer firm that follows NIST SP 800-86's forensic guidance and documents chain of custody from the first image is doing the work that makes the certificate possible. A well-meaning administrator who reinstalls the server at 3 a.m. is doing the opposite.
Paying a ransom: the legal position
India has no statute that prohibits paying, but CERT-In has consistently advised against it, and Indian counsel warn that payments can engage anti-money-laundering and terrorist-financing law, so legal and compliance advice must come before any contact with the attacker. The US Treasury's 2021 advisory says the government "strongly discourages the payment of cyber ransom or extortion demands", that sanctions penalties apply "based on strict liability", and that prompt self-reporting to law enforcement is "a significant mitigating factor". The UK government confirmed in July 2025 that it intends to ban payments by public sector bodies and critical infrastructure operators and to require notification by everyone else; as of early 2026 that had not become law. A retainer firm should know this landscape and should never be the one deciding whether to pay.
Questions to ask before you sign
- Who exactly responds, and how many responders are on call for your region? Ask to meet them.
- What is the response time, measured from what, and does it change at weekends and on holidays?
- What does onboarding cover, how many hours does it get, and what access will you hold in advance?
- Do you have reporting templates for CERT-In, RBI's DAKSH platform, SEBI, IRDAI and the DPDP Board, and will you draft the submissions with us?
- If we do not use the hours, what happens to them?
- Are you on our insurer's panel, or will the insurer approve you in writing now?
- How do you handle evidence, and can you support a section 63 certificate?
- What is excluded, and what does a second concurrent incident cost?
- Will you run a tabletop exercise with our leadership in the first quarter?
- Can you show us a sanitised example of a final incident report?
What assured schemes tell you, and what they do not
Some markets have formal assurance for response firms: the UK's NCSC Cyber Incident Response scheme, with Enhanced and Standard levels delivered through partners such as CREST, is the best known. These schemes tell you a firm has met a documented standard in that market. They do not tell you the firm knows your regulators, your environment or your insurer, which is what the onboarding and the exercises are for. Judge any firm on the questions above first.
Making the retainer worth having
A retainer that sits in a drawer is a phone number. One that works has been exercised, and the exercise has changed something. The first crisis simulation with the retainer team usually reveals that nobody can reach the backups' administrator at night, that the DAKSH login belongs to someone who left, or that the board does not know who can authorise a shutdown. Those are cheap to fix in an exercise and expensive to discover in an incident.
Our incident response retainer is built on that principle: environment onboarded before day one, playbooks for the regulators you actually answer to, and unused hours convertible to readiness work. The digital forensics and incident response team behind it is the same one that responds, and a managed SOC can shorten the gap between the attacker arriving and the retainer being called.
Frequently Asked Questions
Click any question to expand the answer.
QWhat is an incident response retainer?
A standing contract with an incident response firm, agreed before any incident, that fixes who responds, how quickly, at what rate, and with what preparation. It typically includes onboarding of your environment, reporting playbooks for your regulators, either prepaid hours or a no-fee arrangement with fixed rates, and exercises.
QDo we need an incident response retainer?
If a regulator gives you hours rather than days to report, if your cyber insurer requires a panel firm, if you have no in-house response capability, or if you could not say today who would run your response, yes. Under CERT-In's 2022 directions, almost every Indian body corporate has a six-hour reporting duty.
QWhat is the difference between a prepaid and a zero-fee retainer?
A prepaid retainer buys a block of hours at a fixed rate in advance, often convertible to readiness work if unused. A zero-fee retainer costs nothing up front, fixes the hourly rate and response time, and bills per incident. The first guarantees capacity; the second guarantees terms.
QWhat should the response time be?
A contractual time to first contact with a qualified responder measured in a few hours, with a separate commitment for hands-on remote or on-site work. Check whether the time is to an analyst or to a call centre, and whether it holds at weekends and on Indian holidays, when many attacks are timed.
QHow does a retainer help with six-hour reporting?
The six-hour clocks under CERT-In's directions, RBI's 2026 directions and SEBI's framework start from noticing or detection, before you have the facts. A retained team that already knows your environment can establish what happened quickly, and the retainer's playbooks say which form goes to which regulator with what content.
QDoes cyber insurance require a retainer?
Often. Industry guidance quotes Gartner as noting that cyber insurance policies typically require a DFIR retainer, and insurers run panels of approved firms. At least one major insurer's wording says non-panel providers must be listed on the policy before any incident. Check your policy's panel, consent-to-incur and notice provisions before signing a retainer.
QShould we engage the retainer through our lawyers?
Engaging the firm through counsel is commonly recommended where legal privilege over the investigation matters, but privilege is not guaranteed by structure alone and the position differs by jurisdiction. Take legal advice when setting up the retainer, not during the incident.
QWhat happens to unused retainer hours?
It depends on the contract. The better arrangements let unused prepaid hours be spent on readiness work such as tabletop exercises, assessments or testing; others let them expire. Ask before signing.
QIs it legal to pay a ransom in India?
There is no statute prohibiting it, but CERT-In has consistently advised against paying, and Indian counsel warn that payments can engage anti-money-laundering and terrorist-financing law. The US Treasury strongly discourages payment and applies sanctions penalties on a strict liability basis. The UK has proposed a ban for public sector bodies and critical infrastructure operators that was not yet law as of early 2026.
QHow should evidence be handled in an incident?
Disconnect rather than power down where possible, because powering down destroys evidence in memory; take system images and memory captures of affected devices; and preserve volatile and short-retention evidence first. In India, electronic records need a certificate under section 63 of the Bharatiya Sakshya Adhiniyam, including hash values, so chain of custody from the first image matters.
QWhat does NIST SP 800-61 Revision 3 say about outside responders?
Published in April 2025, it says third parties may be under contract to help perform incident response activities, and that these responsibilities should be clearly defined in a contract, with the incident response team aware of the division of responsibilities, information flows, coordination and authority to act on behalf of the organisation.
QHow often should we exercise the retainer?
At least once a year, with a tabletop exercise involving the retainer team and your leadership. The first exercise usually finds practical gaps such as unreachable administrators, unused regulator portal logins or unclear authority to shut systems down.
Related reading
For the response process itself, see the SOC incident management playbook. For the attack most retainers are called for, the ransomware defence playbook for India. For designing systems that keep working through an incident, cyber resilience engineering. For the reporting duties arriving in 2027, the 180-day DPDP readiness plan.
Sources
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (28 April 2022).
- Reserve Bank of India, NBFC – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026.
- Securities and Exchange Board of India, Circular on cyber incident reporting under the CSCRF (August 2026).
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, Rule 7.
- European Union, Commission Delegated Regulation (EU) 2025/301 on major ICT-related incident reporting under DORA.
- US Securities and Exchange Commission, SEC adopts rules on cybersecurity risk management, strategy, governance and incident disclosure (July 2023).
- Personal Data Protection Commission Singapore, Before you report a data breach.
- NIST, SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management.
- NIST, SP 800-86: Guide to Integrating Forensic Techniques into Incident Response.
- CISA, #StopRansomware Guide.
- US Department of the Treasury, OFAC, Updated advisory on potential sanctions risks for facilitating ransomware payments (September 2021).
- Goodwin, The UK's ransomware strategy (February 2026).
- Cyril Amarchand Mangaldas, Cyber Incident Response Handbook (2025).
- LiveLaw, How the Bharatiya Sakshya Adhiniyam transformed digital evidence.
- Chubb, Non-panel incident response service providers.
- Arctic Wolf, Understanding the value of incident response retainers.
- UK NCSC, Cyber Incident Response scheme updates.
- Google Cloud / Mandiant, M-Trends 2026.
- Sophos, The State of Ransomware 2026.
- IBM India, India records its highest average cost of a data breach, 2026.
Adayptus Consulting
Incident Response, Adayptus
Adayptus Consulting Private Limited is a cybersecurity consultancy based in Noida, India, responding to incidents for clients in India, the Gulf, the UK, Singapore and the US under the reporting clocks each one sets.
On This Page
- The clocks that make the case
- What the standards expect you to have arranged
- Who needs a retainer
- What a retainer should include
- Evidence: the part that cannot be redone
- Paying a ransom: the legal position
- Questions to ask before you sign
- What assured schemes tell you, and what they do not
- Making the retainer worth having
- Frequently Asked Questions
- Related reading
- Sources
