FIELD-TESTED CRISIS RESPONSE TEAM. AVAILABLE 24/7. GERMAN-SPEAKING.
Incident Response Retainer for emergencies
In a cyber incident, fast access to experienced specialists is critical. With our incident response retainer, you have a field-tested SHE crisis response team at your side that handles even complex threats calmly and intelligently, based on lessons from real engagements. Response paths, service levels, and scope are agreed individually in your contract.
What is an incident response retainer?
An incident response retainer is a pre-arranged agreement between a company and an incident response provider. The contract ensures rapid access to an experienced team with agreed service levels during incidents. Internationally, this model is known as an “incident response retainer”.
Goal. Do not lose time on vendor search, negotiations, or onboarding during an incident. Instead, use an experienced team with clear escalation paths immediately.
Billing model. Typically a monthly or annual fee for guaranteed availability plus SLA-based service effort. In our Best Effort package, no base fee applies.
Difference from cyber insurance. Cyber insurance covers financial losses. An incident response retainer provides the technical forensics and response team. Both models complement each other.
IR retainer: our offers for you
IR Best Effort
- Response time: Next business day (best effort, no guaranteed SLA times)
- Staffing: Remote IT security engineer, subject to availability
- No base fee
IR Retainer Advanced
Our recommendation: the all-in package
- Response time: short response times according to jointly agreed SLAs
- Staffing: in confirmed incidents, involvement of an IR coordinator and an IT security engineer; support starts remotely and can be on site by agreement
- Monthly fee
- Option 1: Annual IR simulation workshop
- Option 2: Initial onboarding session
- Option 3: 2 status meetings per year
IR Retainer Premium
- Response time: prioritized incident handling with short response times according to agreed SLAs
- Staffing: in confirmed incidents, involvement of an IR coordinator and, depending on scope, an extended engineering team; primarily remote, on site by agreement
- Monthly fee
- Option 1: Annual IR simulation workshop
- Option 2: Initial detailed onboarding of your environment
- Option 3: 4 status meetings per year
The benefits of an incident response retainer
Improved security. A strategic incident response plan significantly reduces the impact and costs of a security breach.
Defined availability. Access to specialized incident response contacts within agreed on-call and service hours.
Fast response. Defined response paths and response times for your company in line with agreed service level agreements.
Reduced recovery time. Prepared communication channels and predefined response plans significantly shorten recovery times.
Better cost control and response capability.Predictable budgets and improved response readiness through tabletop exercises and readiness assessments improve both cost and response performance. You benefit from flexible use of retainer hours.
Why SHE as your IR retainer partner
Field-tested crisis response team. We have handled real cyber crisis situations. This experience flows into every retainer contract and playbook.
German-speaking team from Ludwigshafen. Our Security Operations Center is based in Ludwigshafen. In incidents, you speak with German specialists who understand German authority structures and escalation paths.
ISO 27001 certified. We run our own security operations according to ISO 27001 and know audit requirements from practical experience.
Who needs an incident response retainer?
Companies with critical IT. If your business depends on IT systems (production, e-commerce, logistics, financial services), you cannot afford vendor search during incidents. A pre-arranged retainer saves the critical first hours.
Companies subject to NIS2. The NIS2 implementation law requires reporting major security incidents within 24 hours (section 32 BSIG). An experienced forensics team supports timely reporting.
Cyber-insured companies. For higher coverage amounts, cyber insurers often require a pre-agreed incident response provider.
ISO 27001-certified companies. The standard requires a tested incident response process. A documented retainer is a recognized form of evidence.
Mid-sized companies without an in-house forensics team. If you cannot or do not want to build your own forensics team, a retainer gives you on-demand expertise.
Ready for the next step?
Talk to our incident response team in Ludwigshafen about your infrastructure, risks, and a suitable package. Our experts will be happy to advise you.
Contact Person
Let’s talk about your project.
Book a free initial consultation with our team at
+49 621 5200-0.
FAQ
What is an incident response retainer?
An incident response retainer is a pre-arranged agreement with an incident response provider. In an incident, the contract ensures rapid access to an experienced team and defined service levels.
What is the difference from cyber insurance?
Cyber insurance covers financial losses. An incident response retainer provides the technical forensics and response team. Both models complement each other. Many cyber insurers recommend or require a retainer as part of the policy.
Which packages do you offer?
Three tiers: IR Best Effort (next business day, no base fee), IR Retainer Advanced (agreed SLAs, monthly fee, workshop and status appointments included), IR Retainer Premium (prioritized handling, extended engineering team, more status appointments per year).
How quickly do you respond in an incident?
Response times depend on the selected package and SLA classes. Best Effort starts on the next business day; Advanced and Premium use short, pre-agreed response times according to the SLA.
How much does a retainer cost?
This depends on the selected package, the complexity of your infrastructure, and agreed service levels. Best Effort has no monthly base fee; Advanced and Premium use a monthly fee plus service effort. We provide an individual offer after the initial consultation.
Who needs an incident response retainer?
Companies with critical IT, NIS2-affected organizations, ISO 27001-certified companies, cyber-insured organizations with higher coverage amounts, and mid-sized companies without their own forensics team.
What is included in the retainer?
Depending on the package: defined availability, agreed response paths according to SLA, IR coordinator and IT security engineer during incidents, initial onboarding session, IR simulation workshops, and regular status meetings.
Does a retainer fulfill NIS2 requirements?
A documented incident response retainer with agreed response paths, tabletop exercises, and defined availability supports compliance with key requirements in section 30 BSIG (emergency management) and section 32 BSIG (reporting). Final assessment is done within your compliance program.
How does authority escalation work?
On request, we support BSI notifications, GDPR notifications to data protection authorities, and communication with cyber insurers. Scope is defined in the contract.
