Cyber incident response: know who to call before the crisis
When an incident happens, you know who to call.
A ransomware attack, an email compromise, a data leak: incidents rarely arrive at a convenient time. The first hours often decide the extent of the damage. Searching for a provider at that moment costs precious time.
The annual retainer prepares the response in advance. The response plan is written with your teams, contacts and access are ready, and a crisis exercise tests the set-up. On the day of an incident, intervention is a priority: containment, investigation and restoration of service.
Notification obligations run in parallel. For entities subject to NIS2, Article 23 requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. For a personal data breach, GDPR requires notification to the French data protection authority (CNIL) within 72 hours. These deadlines are prepared with you.
What you get
- Incident response plan: roles, contacts, decision trees, communication templates
- Tabletop crisis exercise with management and key teams
- Priority intervention in case of incident: containment, investigation, restoration
- Preparation of NIS2 and GDPR notifications to the competent authorities
- Lessons-learned report and hardening plan after each incident
How it runs
Preparation
Inventory of critical systems, contacts and emergency access. Drafting of the response plan with your teams.
Exercise
Simulation of a realistic incident with management. Weaknesses in the plan are corrected before a real incident reveals them.
Intervention
In case of an incident, priority mobilisation: contain the attack, preserve evidence, identify the origin and restore services to a clean state.
Lessons learned
Analysis of what happened and what worked, followed by a hardening plan to prevent recurrence.
Frequently asked
What if an incident occurs before preparation is complete?
Intervention remains possible from the day of signature. Preparation simply makes the response faster and better coordinated, which is why it is worth starting early in the retainer.
Who notifies authorities of an incident?
Notification remains an obligation of your organisation. The retainer prepares the content, tracks the deadlines under Article 23 of NIS2 and GDPR, and supports your contacts in exchanges with authorities.
Does this retainer replace cyber insurance?
No, the two are complementary. Insurance covers financial consequences; the retainer organises the technical and operational response. It is worth checking how your insurance policy fits the two together.
Further reading
- DORA ICT incident report: what 3,383 cases reveal12 October 2026
- Local authorities and the Resilience Law: what the Hauts-de-France attack reveals about governance of your digital suppliers6 October 2026
- Cybermois 2026: 45% of French people have received a breach notice, and what the CNIL-Cybermalveillance guide reveals about your GDPR Article 34 process3 October 2026
In the same practice area : Security
- Posture assessment
Where you stand, and what is missing.
- Compliance programme
Measures deployed, documented, provable.
- Fractional CISO
Accountability sits with management. We carry the file with them.
- Security tooling integration
A tool installed is not a tool in service.
- Penetration testing
Find the flaws before those who are looking for them.
- Preparation for ISO/IEC 27001 certification
From gap analysis to the certification audit.
- Awareness training and phishing simulations
The first attack vector is still people. They can be trained.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call