An incident-response retainer establishes the commercial, operational and communication arrangements needed to engage CTG quickly when a serious cybersecurity incident occurs. The service is for organisations that cannot afford to negotiate scope, access, contacts and evidence handling for the first time during an active incident.
Link is copied!
Incident-Response Retainers
Under attack now? Call +359877886044 or email incident@ctg.bg for active or suspected incidents.
Outcomes this service supports
The purpose is to reduce decision time during disruptive events, preserve evidence and support controlled recovery.
- Create a tested route to engage incident specialists.
- Confirm decision-makers, contacts and communication channels.
- Reduce delays caused by procurement and access uncertainty.
- Improve evidence readiness and incident procedures.
- Use exercises and reviews to strengthen response before an event.
What we cover and produce?
We agree the precise scope up front. Depending on the objective, environment and authorised access, the engagement may cover:
- Retainer objectives, service hours and mobilisation model.
- Named contacts, escalation and authority.
- Pre-approved commercial and confidentiality arrangements.
- Secure communication and evidence-transfer channels.
- Environment, logging, access and third-party dependencies.
- Initial triage and severity criteria.
- Exercises, readiness reviews and included hours.
- Renewal, unused capacity, exclusions and partner involvement.
How delivery is structured?
Agree priority scenarios, service boundary, contacts, response assumptions and commercial model.
1. Design the retainer:
Document systems, logs, secure channels, authority and emergency access.
2. Prepare access and evidence:
Run a call-tree test or tabletop exercise to validate roles and decisions.
3. Exercise the arrangements:
Review contacts, environment and dependencies at agreed intervals.
4. Maintain readiness:
Use the agreed triage and mobilisation route, then manage incident work under the retainer terms.
5. Activate when needed:
What you receive?
Outputs are prepared for executives and for the technical teams doing the remediation. Depending on scope, they may include:
- Retainer service description and responsibility matrix.
- Contact and escalation plan.
- Secure communication and evidence-transfer procedure.
- Environment and readiness profile.
- Triage and mobilisation workflow.
- Exercise report and improvement actions.
- Periodic readiness review.
How we keep the work controlled?
Contacts, authority, secure communications, evidence handling and escalation are defined before sensitive work begins. Conclusions distinguish confirmed facts, reasonable hypotheses and unavailable evidence, and recovery actions are validated before closure.
Typical triggers for this work
- Regulatory or customer obligations require response readiness.
- The organisation lacks specialist forensic capacity.
- Procurement delays would materially increase impact.
- Critical suppliers must coordinate during incidents.
- Ransomware, BEC or cloud compromise is a material risk.
- Leadership wants tested rather than purely documented readiness.
Frameworks, scheduling and scope limits
The engagement may draw on NIST incident-response guidance, ISO/IEC 27035 concepts, applicable regulatory and evidence requirements. Where we cite a standard, it explains our method only — it is not a certification, accreditation or official determination.
We confirm the timeline at scoping; it reflects the environment's complexity, the evidence on hand and access to the right people.
The retainer must state verified service hours, acknowledgement targets, mobilisation assumptions, included work, travel, partner dependencies and exclusions. It does not guarantee availability beyond the contracted terms or a specific incident outcome.
Discuss Incident-Response Retainers with us. In a focused scoping call we agree the objective, scope, evidence, delivery model and outputs, then send a proposal.
Related services
Frequently asked questions
What does Incident-Response Retainers cover?
We agree the precise scope up front. Typical areas include retainer objectives, service hours and mobilisation model, named contacts, escalation and authority, pre-approved commercial and confidentiality arrangements, and secure communication and evidence-transfer channels. The proposal documents what is out of scope, what access we need, what you provide and how success is judged.
What will we receive at the end of the engagement?
Deliverables depend on the agreed objective and may include retainer service description and responsibility matrix, contact and escalation plan, secure communication and evidence-transfer procedure, and environment and readiness profile. We connect each key conclusion to its evidence, its impact, its priority and an accountable action.
What should we do before sharing incident evidence?
Use the approved secure communication and transfer route. Preserve original data where possible, record who handled it and avoid unnecessary changes to affected systems until response priorities are agreed.
Can CTG guarantee recovery or a particular outcome?
No. Incident conditions, access, damage and third-party dependencies vary. CTG can support containment, investigation and recovery within the agreed scope, but cannot guarantee data recovery, attribution or absence of further compromise.
How long does the engagement take?
We confirm the timeline at scoping; it reflects the environment's complexity, the evidence on hand and access to the right people.
How does this relate to Emergency Cybersecurity Response?
They address adjacent but separate needs. Scoping identifies whether Incident-Response Retainers, Emergency Cybersecurity Response, or a coordinated programme is the smallest useful approach without duplicating work.
What are the principal limitations?
The retainer must state verified service hours, acknowledgement targets, mobilisation assumptions, included work, travel, partner dependencies and exclusions. It does not guarantee availability beyond the contracted terms or a specific incident outcome.