Cybersecurity Incident Response Services: Plan, Retainer and First-Hour Playbook
The first hour of a breach is decided by what was written down before it. Who isolates the machine, who calls the insurer, who talks to the client whose data may be gone, who is allowed to approve a payment. Incident response services from NetSys put those answers on paper, rehearse them with your leadership, and back them with engineers who pick up the phone.
The short answer
Incident response services prepare a business for a breach, ransomware attack or account compromise, and put engineers to work when one happens. NetSys writes the plan and the first-hour playbook, rehearses them with your leadership in tabletop exercises, and provides a retainer for triage, containment, recovery and coordination with your insurer and counsel. Managed clients get all three month to month; other businesses can engage the planning and retainer standalone, remotely anywhere in the United States.
Most businesses meet their incident response plan for the first time when the insurer asks whether they have one. The document written to satisfy that question is usually a template with the company name substituted in, and it fails on the day because nobody has read it. A usable plan is short, names real people with phone numbers, and assumes email and shared drives may be unavailable when you need it.
NetSys has handled more than 30 ransomware incidents in the past three years, every one fully recovered, and the clients with a disaster recovery plan in place were back within 24 hours. The difference between one day and one week was almost never the malware. It was whether the first hour had been decided in advance.
Plan, Rehearse, Retain
Planning starts with a half-day session with owners, operations and whoever runs IT, producing a plan that fits on a few pages: roles, contact tree, severity levels, the first-hour playbook, notification duties under HIPAA, NY SHIELD, DFS or contract, and the insurer's claim steps. We then run a tabletop exercise, usually a ransomware scenario at 4pm on a Friday, and revise what broke. The retainer sets terms in advance: how to reach us, what we are authorized to do on arrival, and how evidence is preserved so the insurer's forensics firm and your counsel get what they need. Both are reviewed annually and after any real incident.
What Incident Response Services Include
The Incident Response Plan
Short enough to be read at 2am.
- Roles and a contact tree with cell numbers, including your NetSys account manager
- Severity levels that decide who is woken up and when leadership is involved
- Notification obligations mapped: HIPAA, NY SHIELD Act, NY DFS, contracts and your cyber policy
- Printed and stored offline, because the plan on the encrypted file server helps nobody
The First-Hour Playbook
What to do before anyone has to think.
- Isolate first, investigate second: pull the network cable, do not power off, do not wipe
- Who calls NetSys, who calls the insurer's hotline, who says nothing to anyone else yet
- Preserve evidence: logs, a photo of the ransom note, the affected device left as it is
- Holding statements for staff, clients and vendors, written in advance
Tabletop Exercises
Practice with the people who would live it.
- Scenario-based exercise with owners, operations, finance and IT, run by a NetSys engineer
- Ransomware, business email compromise and lost-laptop scenarios drawn from cases we have worked
- Findings list: the gaps the exercise exposed and who fixes each one
- Repeated annually and whenever leadership or systems change materially
The Retainer
Engineers who already know your environment.
- Pre-agreed authorization, so containment starts on the first call rather than after a contract review
- Containment, forensic preservation, recovery and root-cause analysis
- Coordination with your cyber-insurance carrier, breach counsel and any forensics firm they appoint
- Included for NetSys managed clients; standalone retainer available for businesses with internal IT
Why Businesses Choose NetSys for Incident Response
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your incident response planning & retainer stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- Written by engineers who have run the first hour of real ransomware incidents, not copied from a template
- Tabletop exercises are scenario-driven and end with an assigned fix list
- Retainer terms and authorizations are settled in advance, so the first call starts work
- Insurer, counsel and forensics coordination handled with you, in the order the policy requires
- Recovery planning and backups managed by the same team, so the plan and the restore match
- Month to month, like every NetSys agreement
Incident Response Planning & Retainer in practice
- Manufacturing
Precision machining company recovering from ransomware
Recovery and restoration of 3 servers and 45 workstations, followed by EDR deployment and immutable backup implementation.
Client names are withheld. Each card is the scope of a real NetSys engagement, as delivered.
How a response runs, phase by phase
How long each phase takes depends on the incident. The order does not, and it lines up with NIST's incident response guidance:
- First hour: triage the report and set its severity, isolate affected devices, preserve evidence, call NetSys and your insurer's hotline, and hold outside communication
- Containment: disable compromised accounts, block the entry point and stop the spread, within the authority agreed in advance
- Scoping: establish which systems and records were touched, from logs and forensic evidence, so counsel has facts for notification decisions
- Remediation and recovery: remove what the attacker left behind, restore from offline, immutable backups in business-priority order, rotate credentials and confirm systems are clean
- Notification decisions: leadership and counsel decide on notices under HIPAA (45 CFR Parts 160 and 164), the NY SHIELD Act (GBL §899-aa), 23 NYCRR 500 or your contracts, and we supply the facts
- Review: root cause, a fix list with owners, and an updated plan and playbook
This is general information, not legal advice. Notification deadlines differ by law and contract, and your counsel owns those decisions.
Retainer options
Three ways to arrange incident response with NetSys. None comes from a public rate card; each is scoped to your environment:
| Option | Who it fits | What's included | How it's priced |
|---|---|---|---|
| Included in managed IT | NetSys managed clients | The IR plan, tabletop exercises, the first-hour playbook and the response retainer | Inside the month-to-month managed agreement |
| Standalone retainer | Businesses with internal IT | Planning as a fixed-scope project, plus a retainer with authorization and contact paths agreed in advance | A project fee for planning and a monthly retainer, quoted after a short scoping call |
| Emergency engagement | Businesses with no prior relationship | Containment, recovery and coordination with your insurer, breach counsel and any forensics firm they appoint | Quoted at the time of the incident |
With a retainer, containment can start on the first call because authorization is already settled. Without one, the first hours go to agreeing terms and access.
Incident response, digital forensics and legal advice: who does what
A serious incident brings several parties to the table. Each has a different job, and the plan names them in advance:
| Party | What they do | Who brings them in |
|---|---|---|
| NetSys incident response | Triage, containment, evidence preservation, recovery from backups, the root cause and the fix list | You, through the retainer or the managed agreement |
| Digital forensics firm | A formal forensic investigation of what was accessed and when, where the claim or the case calls for one | Your cyber insurer or breach counsel |
| Breach counsel | Legal advice on notification duties under the laws and contracts that apply, and on what is said to clients and regulators | You or your insurer |
| Cyber insurer | The claim, and the procedure the policy requires you to follow to keep coverage | Named in your policy |
Where incident response ends and recovery planning begins: Incident response vs disaster recovery and digital forensics.
We preserve the evidence and supply the facts; the forensics firm and counsel reach their own conclusions. General information, not legal advice.
Where we deliver Incident Response Planning & Retainer
Incident Response Planning & Retainer in New York City · Incident Response Planning & Retainer in Brooklyn, NY · Incident Response Planning & Retainer in Westchester County · Incident Response Planning & Retainer in New Jersey · Incident Response Planning & Retainer in Stamford, CT. We also support clients remotely wherever their systems run. See all locations and service areas.
Incident Response Planning & Retainer FAQs
What is incident response?
Incident response is how a business handles a security incident, such as ransomware, a compromised email account or a lost laptop with client data: confirm what happened, contain it, remove the attacker's access, recover and learn from it. NIST's earlier guide described four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The current version, SP 800-61 Rev. 3 from April 2025, maps the work to the CSF 2.0 functions, with detect, respond and recover as the response itself and govern, identify and protect as the preparation around it.
What are incident response services?
Incident response services prepare a business for a security incident and support it when one happens. Preparation means a written plan, a first-hour playbook and tabletop exercises. Support means a retainer that puts engineers to work on containment, evidence preservation, recovery and root-cause analysis, coordinated with your insurer and counsel. NetSys provides both to managed clients within the agreement and to other businesses as a standalone engagement.
What should an incident response plan include?
A cyber attack incident response plan should cover eight parts: roles and a contact tree with cell numbers; how incidents are detected and triaged by severity; containment; eradication and recovery from offline backups; communications with staff, clients, your insurer and breach counsel; evidence preservation; notification decisions under the laws and contracts that apply; and a lessons-learned review. Keep it short and on paper. Our six-step guide to a small business cyber attack response plan walks through each part.
What is an incident response retainer?
A pre-arranged agreement that engineers will respond when you call, with scope, authorization and the contact path settled before the incident. Without one, the first hours of a breach go to finding a firm, agreeing terms and getting them access. With one, containment starts on the first call. For NetSys managed clients the retainer is built into the agreement.
Do we need incident response services if we have cyber insurance?
Yes, because the policy pays for response; it does not perform it, and most carriers require you to follow their procedure to keep coverage. A plan that names the carrier's hotline and the steps the policy requires, rehearsed in advance, is what keeps the claim clean. We work with the carrier's appointed forensics firm and breach counsel rather than around them.
Do incident response services include digital forensics?
They include the forensic groundwork. Our engineers preserve the evidence, establish from logs which systems and records were touched, and find the root cause. Where your insurer or breach counsel appoints a digital forensics firm for a formal investigation, we work with that firm and give it the evidence and access it needs, and counsel decides what the findings mean for notification.
How much do incident response services cost?
Planning, tabletop exercises and the response retainer are included in the all-inclusive month-to-month NetSys managed agreement. Businesses with internal IT can engage the planning as a fixed-scope project and the retainer as a standalone monthly arrangement; both are quoted after a short scoping call. Emergency response for a business with no prior relationship is quoted at the time, and we still pick up the phone.
How do we get started with incident response planning?
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. Incident response planning requires a separately scoped review of systems, identities, backups and responsibilities. Call 845-203-3914 or use the contact page to discuss the next step.
What does a real ransomware response look like?
It looks like isolation first, then a restore from backups the attacker could not reach. In one published case, a seven-location restaurant group received a 7-Bitcoin demand on a Saturday. NetSys isolated the affected systems and restored from immutable backups, and the group was fully operational in 4.5 hours with 100% of its data. The demand went unanswered.
Who should be on a small business incident response team?
A small team with clear authority: an owner or executive who can approve spending and statements, someone from operations, finance for payment decisions, your IT lead or NetSys engineer, and contacts for your cyber insurer and breach counsel. Name a backup for each role and keep cell numbers stored offline, because email may be down.
Sources and technical references
Guides on this topic
- How to Write an Incident Response Plan
- Ransomware Protection & Recovery
- Disaster Recovery Planning
- Cyber Insurance Readiness
- Managed Detection & Response (MDR)
- Response-time table for managed IT clients
- Ransomware defined, and why tested backups decide recovery
- SOC as a service for security monitoring and escalation
- SHIELD Act safeguards and breach response
- Ransomware Tabletop Exercise: How Small Businesses Run One
Decide the first hour before you live it.
Planning starts with a half-day session with the owners and whoever runs IT. What comes out fits on a few pages: a contact tree with cell numbers, and the first-hour steps. We then run the tabletop, and it ends with a fix list naming who owns each gap.