# What is an incident response retainer, and do we need one?

A retainer is an agreement with an incident-response firm, signed before anything happens, that guarantees you a response within an agreed time and fixes the price and the terms. Without one, you are searching for a provider, negotiating a contract and granting access while the attacker is still active. Many cyber insurers have their own panel of response firms and expect you to call them first, so check your policy before signing anything separately. A small company may not need a paid retainer if the insurer's hotline covers this, but it does need to know whom to call, what that firm needs on day one and how it will reach your systems. NetSenX is not an incident-response firm. It gives the firm you call explained alerts and a network history from before the incident, which is usually the evidence that is hardest to reconstruct afterwards.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-is-an-incident-response-retainer

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is a tabletop exercise, and how do we run one?](https://netsenx.com/en/faq/what-is-a-tabletop-exercise)
- [What is the difference between an event, an alert and an incident?](https://netsenx.com/en/faq/difference-between-an-event-an-alert-and-an-incident)
- [How do we tell a real incident from a false alarm?](https://netsenx.com/en/faq/how-to-tell-a-real-incident-from-a-false-alarm)
- [How do we decide how serious an incident is?](https://netsenx.com/en/faq/how-to-decide-how-serious-an-incident-is)
- [Who makes the decisions during a cyber incident?](https://netsenx.com/en/faq/who-makes-decisions-during-a-cyber-incident)