Reference
The file
Four long-form cards on the parts of a retainer that decide whether it works: the contract, the money, the response-time commitment, and the regulatory duties behind it. Every legal statement is quoted from the instrument itself.
In reading order
-
What is an incident response retainer?
The definition, the six components that recur across real agreements, the three commercial models, and the honest list of things a retainer does not do for you.
Read the guide -
What does an incident response retainer cost?
Nobody publishes a price. What can be established is the structure: three models, the variables that move each one, and the single number worth extracting from a quote.
Read the guide -
The response-time SLA: what the number actually promises
One hour, two hours, next business day. None of those figures says what the responder must have done by then, what starts the clock, or what happens when the target is missed.
Read the guide -
NIS2, DORA and the incident response retainer
Neither instrument requires a retainer. Both require a capability, both run clocks a retainer has to feed, and one of them regulates the retainer contract itself, clause by clause.
Read the guide