A retained incident-response provider exists to do two things: cut the time between discovering an attack and containing it, and produce evidence the regulator and the board can both read.
The clock that matters is the ICO's 72-hour Article 33 clock. It starts when the organisation becomes aware, not when the IR provider arrives.
NIST's long-standing incident-response lifecycle, from SP 800-61 Revision 2, runs in four phases: Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity. Its April 2025 successor, Revision 3, reframes incident response around the NIST Cybersecurity Framework 2.0. NCSC's Cyber Incident Response scheme runs alongside it, with assured providers at Enhanced and Standard levels. This retainer is structured around the ICO clock, so it covers all four phases, not only the response itself.
Pre-agreed scope of action so the responder can isolate hosts, rotate credentials, and revoke tokens without a fresh approval cycle.
Pre-drafted ICO disclosure template, customer-comms boilerplate, and the decision tree for who triggers each, ready before the call comes in.
Chain-of-custody, timestamped log preservation, and a written incident timeline that satisfies the ICO accountability principle.
The recurring pattern from incident-response engagements where the organisation already had a retainer in place: the provider answered the phone inside SLA. The first responder collected log files. The forensic team began analysis on day two. The organisation's executive team had already missed the ICO's 72-hour notification window because the retainer's SLA covered first-call response, not regulatory clock-management. The forensic report was thorough. The disclosure obligation was not.
A retainer that bills hours and runs forensics is a retainer. A retainer that pre-positions the ICO disclosure decision, the customer-comms draft, the board paper, and the regulator-defensible evidence trail is a service.
Ours is structured to deliver the second.
My view shifted from positioning IR retainers as a forensic service. Forensics are part of it. The bigger gap is the line between technical containment and regulatory disclosure. A useful IR retainer pre-positions the disclosure decision, not just the analyst pool. That changed how we structure ours.
The DSIT Cyber Security Breaches Survey 2024 puts it plainly. 50% of UK businesses reported a cyber security breach or attack in the last 12 months. Only 22% have a formal incident-response plan. The gap is not detection capability. The gap is the plan that runs once the detection has happened.
Source: gov.uk Cyber Security Breaches Survey 2024
MDR detects the activity that bypasses preventative controls and triggers the first call. The retainer takes the call, owns the containment, and runs the ICO disclosure clock. One layer is detection. The other is decision and action.
The vCISO decides when an alert becomes an incident requiring board notification and ICO disclosure. The retainer is the operational team that executes containment, evidence preservation, and forensics. Two named roles, one playbook.
MDR runs continuously and detects the attacks that bypass preventative controls. The IR retainer is the team that arrives once an incident has been declared, takes containment authority, and manages the regulatory disclosure clock. Many UK organisations need both. The scoping call covers the boundary between them.
Cyber insurance and an IR retainer are different products. Insurance covers financial loss after the event, subject to policy conditions and breach-notification compliance. The retainer is the operational team that prevents the loss from compounding and produces the evidence the insurer asks for. Check your policy wording for any incident-response requirements, and we will map the retainer against them on the scoping call.
Activation speed depends on the tier and the kind of incident. The scoping call covers tier selection, including which incident classes trigger immediate activation versus next-business-day support. Specific response-time figures depend on the agreement, so we publish them as part of the contract rather than the marketing page.
The Article 33 clock starts when your organisation becomes aware of a personal-data breach. It does not pause while the IR team investigates. The retainer is structured around that reality. Containment work and disclosure preparation run in parallel from the activation call, not sequentially. The disclosure template is pre-drafted as part of onboarding so the legal-and-comms work does not start from a blank page.
The retainer is structured around NIST's incident-response guidance (the four-phase lifecycle of SP 800-61 Revision 2, reframed around the Cybersecurity Framework 2.0 in its April 2025 successor, Revision 3) and the ICO Article 33 72-hour disclosure clock. NCSC publishes its assured-provider list at ncsc.gov.uk/section/products-services/cir for organisations whose threat model requires that specific assurance tier. Whether your engagement needs that tier is something we cover on the scoping call.
If you already have a named forensic team, the retainer can wrap around them rather than replace them. Our scope in that arrangement is containment authority, disclosure clock-management, and the regulator-facing evidence chain. The forensic provider continues to own the deep technical analysis. The scoping call covers exactly how the boundary is drawn.
A natural pre-incident pairing is the retainer with our Cyber Essentials Plus assessment service. CE+ is a point-in-time control assessment of the technical estate. The retainer is the team that runs once those controls have been bypassed. NetSec is an IASME Certification Body, so both can be scoped in the same conversation.