In-House or Retained Incident Response: Choosing Before You Need To

Framing this as in-house versus outsourced produces the wrong answer. Every organisation handles some incidents internally — a phishing report, a single infected laptop — and no in-house team, however good, handles a hospital-wide ransomware event alone, because the volume of parallel work exceeds any internal headcount.

The real questions are where your line sits, and whether the external relationship exists before you need it.

What each is genuinely better at

The independence point is often decisive and frequently overlooked. An insurer, a regulator or a board may place more weight on an external assessment of what happened than on an internal one — not because of doubt about competence, but because of the position the internal team is in.

Where to draw the line

Agree escalation criteria in writing, in advance:

The value is in removing the discussion. At 2am, somebody consults the criteria rather than debating whether it is serious enough to justify the cost.

Retainer structures

A retainer is mostly about guaranteed availability and pre-agreed rates. Options differ in how unused capacity is treated:

• Prepaid hours — a block purchased annually, usable for incidents or, in better arrangements, for proactive work such as tabletops
• Zero-dollar retainer — no fee, but guaranteed response times and locked rates; the provider gets right of first refusal
• Subscription — a fee covering a defined level of response

The terms that matter are covered in the incident response RFP template: response time by severity with the clock starting when you declare, rate protection during surge periods, and whether unused hours convert to proactive work.

Make the relationship real in advance

A retainer nobody has exercised is a phone number. Before an incident:

• Run a tabletop with them, so they know your estate and you know their people
• Confirm they understand clinical constraints — patient safety limits what containment actions are acceptable
• Give them what they need in advance: network diagrams, asset inventory, log source list, contact tree
• Agree data handling — forensic images of clinical systems contain PHI, so the BAA and handling terms need to be in place
• Test the activation path, including out of hours

Check the insurance policy before choosing

Many cyber policies require that you engage a responder from the insurer's approved panel. Using someone else can reduce or void the claim — after the fact, when you have no leverage. If you hold cover, read the panel provision now. Where your preferred provider is not listed, insurers will often add them on request in advance; they will not do it at 2am on the day. The same policies frequently require notification within a short window of discovery, which belongs in your escalation criteria alongside everything else.

Where to start

If you have no retainer, get one — the zero-dollar variety costs nothing and guarantees availability and rates. If you have one, check when it was last exercised. An unexercised retainer and no retainer are closer than the contract suggests.

GuardsArm provides incident response retainers for healthcare, including tabletop facilitation using retainer hours. Book a scoping call.