The call you hope not to make. Answered.
A retainer means the paperwork is done before the incident: NDA, contacts, severity matrix, escalation tree and pre-agreed rates. When you call, the first hour is spent on containment, not contracts.
Is this you?
- Something is wrong right now. Under attack? Get help now
- You have no incident-response plan the CBI would accept.
- You have never run a tabletop exercise.
- You run a network, a store or an app, and no one owns the first hour of an incident.
What you get
- Severity matrix, S1 to S4auditor
- Incident-response plan and playbooks aligned to the CBI’s notification dutiesauditorengineers
- Tabletop exerciseboard
- Retainer hours and pre-agreed ratesboard
- Post-incident report template for the board and the regulatorboardauditor
What it maps to
| Regulation / standard | What DigiFort delivers |
|---|---|
| CBI Cyber Resilience Controls | Severity matrixincident-response plan and playbookstabletop exerciseretainer hours and pre-agreed ratespost-incident report template |
How we do it
- Prepare — the retainer and the plan, agreed in calm time and tested in a tabletop exercise.
- Triage — we confirm what is happening and agree the severity on the matrix. Your side: the CISO or IT head. Ours: the practice lead, who escalates along the tree you agreed.
- Contain — stop the spread first, and keep the evidence intact while we do.
- Investigate and recover — find the cause, remove it, and bring systems back in an agreed order, each one checked before it returns.
- Report — the post-incident report for your board and the regulator; its lessons go back into the plan.
Boundaries
A retainer prepares you for an incident; it does not promise that none will happen. The duty to notify the CBI and to inform your customers stays with you, and we help you prepare what you send. Response hours, on-site cover and languages are agreed in each retainer.
FAQ
Where is our data handled?
Agreed with you in writing before the engagement starts: where each deliverable is stored, in which region, who can open it, and how it is handed back or deleted when we finish.
Why sign a retainer before anything happens?
With a retainer, the NDA, contacts, severity matrix and rates are agreed before anything happens, so the first hour goes to containment. Without one, the same paperwork has to be done during the incident, in time you need for containment.
What happens in a tabletop exercise?
The people who would handle a real incident walk through a realistic one, from the first alert to the board briefing, using your plan. It shows where the plan holds and where it does not.
Our plan has never been tested. Where do we start?
With the tabletop exercise. It tests the plan you have before anything is rewritten, and its findings set the order of the work.