Incident response retainer
A contract signed before any incident with a response provider, guaranteeing a response time and pre-set rates; it must fit with the provider panel required or approved by the cyber insurer.
When an attack strikes, the first hours decide the final cost: isolating systems, preserving evidence, stopping exfiltration. Looking for a provider at that point wastes precious time, and the best ones are often already engaged on other crises. The retainer solves this problem. The company signs in advance with a provider, negotiates rates, sometimes prepays a block of hours usable for audits if no incident occurs, and obtains a commitment on response time. The provider can also learn the client's environment ahead of time, which speeds up intervention. The difficulty arises with insurance. Most cyber policies provide that incident response costs are covered when the insured uses a provider on the insurer's panel, or one it has approved. A retainer signed with an off-panel provider may therefore not be reimbursed, or only at panel rates. Hence two practices: choosing one's provider from the panel, or having one's own approved by the insurer at inception. Some insurers now include such a contract in the premium, as a prevention service.
Textbook case: an industrial group signs a retainer with a provider not on its insurer's panel. At inception, its broker obtains an endorsement approving it at its contract rates; after an incident six months later, the 180,000 euros of response work are reimbursed without dispute.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.