CyberSafe · Datasheet
Incident response retainer
A retainer is not a hope. It is a named commander, a 72-hour path, and evidence handling before anyone wipes a disk.
What you get before an event
- Emergency contact tree and decision rights (IT, legal, leadership)
- Containment order: identity, email, segments — not “unplug everything”
- Evidence list: which logs and snapshots must exist
- Insurer and regulator notification triggers (facts only)
What you get during an event
- Command: one voice. No competing vendors in the war room.
- Containment, then reconstruction, then recovery from backups you have tested
- After-action that names the control that would have shortened it
Platform plans (CyberLink / Enterprise) include incident playbooks. Intensive on-site or surge IR is this retainer — scoped separately on purpose.
Active incident now: +264 81 390 6697