Website Incident Response Retainers: What They Cover and How to Choose One

A website incident response retainer is an agreement made before anything goes wrong, so that a named team is ready to help when your site is hacked, defaced, starts redirecting visitors or leaks data. You agree the contacts, the response steps and the terms in advance. When something happens, you make one call instead of shopping for help in the middle of the incident.

Large security firms sell retainers to enterprises. IBM describes its X-Force offering as "an annual subscription-based IR retainer service" with "around-the-clock global hotline and boots on the ground support." Palo Alto Networks says its Unit 42 Retainer "offers prepaid credits and flexible SLAs," and that the credits can also be used on proactive work. A website-scale retainer is smaller and narrower. It focuses on the site, the hosting, the CMS and the vendors around them.

This guide explains what a website retainer should cover, how it maps to the current NIST incident response guidance, how it differs from enterprise incident response, the reporting channels you should know about as of October 2026, and the questions to ask before you sign.

Why Agree on Help Before an Incident

The first hours of an incident decide how bad it gets. Most of the expensive mistakes happen in that window: deleting the malicious file before copying it, restoring a backup that already contains the backdoor, or losing a day because nobody knows who can authorize taking the site offline. Our guide to the first hour of a website incident covers the decisions to make in advance.

A retainer turns those decisions into an agreement with someone who has done this before. It also removes the procurement step. Public bodies in particular may not be able to sign a new contract quickly, so having one in place matters more for them.

Timely example: PHP2Shell, two critical flaws in the PHP engine fixed on 21 October 2026, left many site owners asking whether their site was compromised before it was patched. With a retainer, you already know who to ask. See how to tell whether PHP2Shell was used against your site.

How a Retainer Maps to NIST SP 800-61 Rev. 3 and CSF 2.0

NIST SP 800-61 Rev. 3, published in April 2025, replaced the 2012 Rev. 2. It recasts incident response in terms of the six functions of the NIST Cybersecurity Framework 2.0. In NIST's words, Govern, Identify and Protect help organizations "prevent some incidents, prepare to handle incidents that do occur," while Detect, Respond and Recover help them "discover, manage, prioritize, contain, eradicate, and recover." NIST also says organizations "should use the incident response life cycle framework or model that suits them best."

What a Website-Scale Retainer Covers

Before an incident

• A written playbook tailored to your site, hosting and vendors.
• A contact and escalation list: your decision-maker and deputy, the host, the agency or developer, the domain registrar, payment providers.
• An access checklist: which accounts are needed to investigate, and where those credentials are held if your usual systems are untrustworthy.
• A check that backups exist, are kept separately from the live site and can be restored. See website backup and recovery.
• Confirmation of what logs your host keeps and how long, because you cannot investigate with logs that were deleted last week.

During an incident

• Triage: is this an attack, a misconfiguration or a DNS problem?
• Evidence preservation: full copies of files, database and logs before anything is cleaned.
• Containment advice: password and session resets, key rotation, a holding page if the site is harming visitors.
• Coordination with the host, developer and other vendors so everyone works from the same facts.
• Cleanup and recovery, or oversight of whoever does it. Our guide to removing malware from a website explains what a proper cleanup involves.

After an incident

• A written post-incident report with the likely entry point, what was affected and what was changed.
• A fix list to prevent the same route being used again.
• Help assembling the facts your lawyer, insurer or regulator may ask for.

Website Retainer vs Enterprise Incident Response

Be honest about which one you need. If an incident spreads beyond the website, for example to email accounts or internal networks, a website retainer should tell you so and help you bring in broader forensic support.

Card payments are a specific case. According to the PCI Security Standards Council, PCI Forensic Investigators "help determine the occurrence of a cardholder data compromise and when and how it may have occurred," and must work for a Qualified Security Assessor company with a dedicated forensic practice. If card data may be involved, call your acquirer or payment provider early and follow its instructions.

Reporting: Who to Tell, as of October 2026

This is general information, not legal advice. Your obligations depend on your sector, your state and your contracts. Talk to a lawyer about anything involving personal data.

• CISA. CISA asks organizations to report "anomalous cyber activity and or cyber incidents 24/7 to report@cisa.gov or 1-844-Say-CISA," and its state, local, tribal and territorial page repeats that request for public bodies. There is also an online form at cisa.gov/report.
• FBI IC3. The Internet Crime Complaint Center, run by the FBI, is the central place to report cyber-enabled crime. IC3 warns that scammers impersonate it, so use the official site directly.
• CIRCIA is not in effect. CISA states that reporting under the Cyber Incident Reporting for Critical Infrastructure Act "will not be required until the CIRCIA final rule goes into effect," and no final rule date has been announced.
• FTC Safeguards Rule. Non-bank financial institutions under FTC jurisdiction, such as mortgage brokers and finance companies, must notify the FTC of a breach involving at least 500 consumers' unencrypted information no later than 30 days after discovery, a requirement in effect since May 2024, per the FTC.
• State breach laws. Every state has a breach notification law. The NCSL summary of them was last updated in January 2022, so confirm your own state's current statute with counsel.
• Health data. Clinics should involve their HIPAA privacy or security officer and counsel. The proposed update to the HIPAA Security Rule is still a proposal; HHS lists the final rule as a long-term action.

A retainer can help you gather facts for these reports. Deciding whether and when to notify is a legal decision.

Questions to Ask Before You Sign

1. What exactly is in scope: which sites, hosts, CMS installs and accounts?
2. How do we reach you out of hours, and what response time do you commit to in writing?
3. What does the retainer include without extra charge, and what is billed separately?
4. Can unused time be applied to preparation work such as a playbook review or a backup restore test?
5. What will you need from us in an incident: access, logs, a decision-maker?
6. How do you preserve evidence, and will you give us copies?
7. Will you work with our host and developer, or replace them during the incident?
8. When would you tell us an incident is beyond your scope, and who would you recommend?
9. Can you handle a suspected card data incident, or will you hand off to a PFI through our acquirer?
10. What will the post-incident report contain, and how soon after the incident?
11. How do you protect the credentials and data we share with you?
12. How often do we review the playbook and contacts together?

Much of this overlaps with reviewing any vendor. Our guide to reviewing a host, agency or platform has a questionnaire you can adapt.

Free Resources to Use Alongside a Retainer

• CISA's Cyber Hygiene services, including vulnerability scanning and web application scanning, are free for state, local, tribal and territorial governments and critical infrastructure organizations.
• CISA publishes free guidance for small businesses through its Secure Your Business resources, and a list of no-cost services and tools from public and private organizations.
• For public bodies, the no-cost CIS SecureSuite membership and CIS Benchmarks remain free. Note that the MS-ISAC has been a fee-based membership since federal support ended on 30 September 2025.

Conclusion

A website incident response retainer is preparation you buy before you need it: a playbook, named contacts, agreed steps and someone ready to help preserve evidence, contain the damage and recover cleanly. Choose one sized to your real exposure, get the scope and response commitments in writing, and know where its limits are, especially for card data and legal reporting. A website security assessment is a good way to find your weak points first, and our overview of website security consulting explains how the services fit together. To set one up, see our website security consulting services.

Frequently Asked Questions