What is an Incident Response Retainer? (1 minute read)

Every campaign is encouraged to give some thought and planning to how they will respond to a cyber incident. 

Some campaigns and organizations need the peace of mind of being ready with outside assistance, should a cyber incident occur. There are many firms that can come in after a cyber incident and help determine the scope of events (what data’s been lost, what’s been compromised), conduct forensics to identify what happened and how, and help recover and get back up and running.

An incident response retainer is an agreement with a provider signed in advance so they are ready to respond immediately after an incident occurs. Most require payment in advance even if the services are never used and usually include an hourly rate you will be charged beyond the retainer.

Not every campaign or organization needs an incident response retainer. However, larger campaigns or organizations with more complex technology infrastructure should give it serious thought.

Smaller campaigns and organizations should at least have a vendor or consultant in mind in advance of an incident since time is always of the essence after a cyber incident.

Learn More: Incident Response Process Guidance and Checklist

How To: Get Your Campaign Prepared for a Cyber Incident