Cost Estimates, Best-Fit Selection and Checklists
Incident-response retainer cost in India: hours, response times and what is included
How incident-response (IR) retainers are priced for Indian MSMEs — prepaid hours, response SLAs, forensics, rollover, travel and overlap with MDR and cyber insurance — with illustrative sums.
An incident-response retainer is a yearly contract that reserves expert help for when an attack happens: a hotline, a promised response time, and a block of prepaid hours for investigation, containment, forensics and recovery. For an Indian MSME, illustrative retainers range from about ₹1.5 lakh a year for a small block of remote hours to ₹10 lakh or more for larger blocks with on-site support. The value is in not having to find, vet and contract a firm in the middle of a ransomware attack, and in agreed rates when you need more. This guide explains how retainers are priced and where they overlap with MDR and cyber insurance. It belongs to the best-fit selection method.
What a retainer usually includes
| Element | Typical content | Watch for |
|---|---|---|
| Hotline | 24×7 number to declare an incident | Is it answered by an analyst or a call centre? |
| Response time | Remote engagement within a set number of hours | On-site is usually longer and charged for travel |
| Prepaid hours | A block used for incident work | Expiry at year end, or conversion to other services |
| Rate card | Hourly or daily rates for work beyond the block | Rates for weekends and holidays |
| Readiness services | IR plan review, tabletop exercise, compromise assessment | Whether they consume prepaid hours |
| Forensics | Disk and memory analysis, log review, root cause | Chain-of-custody if evidence may be used legally |
| Reporting | Incident report for management, insurer, CERT-In information | Who prepares regulatory submissions |
How retainers are priced
- Prepaid hours at a discount to the normal rate: for example 40, 80 or 160 hours a year.
- Zero-dollar or low-fee retainers: little or no upfront fee, but you agree the contract and rates in advance and pay as you go.
- Bundled with MDR: some MDR services include a number of incident-response hours.
Illustrative example
| Option | Upfront | Included | Extra hours |
|---|---|---|---|
| Small retainer | ₹1,80,000 | 40 hours remote | ₹5,000 per hour |
| Medium retainer | ₹4,40,000 | 100 hours, on-site in metros | ₹4,800 per hour |
| Pay-as-you-go agreement | ₹0 | Rates fixed, no guaranteed response | ₹6,500 per hour |
A ransomware incident needs, illustratively, 120 hours of work.
- Small retainer: ₹1,80,000 + 80 extra hours × ₹5,000 = ₹1,80,000 + ₹4,00,000 = ₹5,80,000
- Medium retainer: ₹4,40,000 + 20 × ₹4,800 = ₹4,40,000 + ₹96,000 = ₹5,36,000
- Pay-as-you-go: 120 × ₹6,500 = ₹7,80,000, and no guaranteed response time
In a year with no incident, the small retainer costs ₹1,80,000 and the pay-as-you-go agreement nothing. That is the bet. Add 18% GST to each with the GST-inclusive price calculator.
Overlap with MDR and cyber insurance
- MDR contains incidents on endpoints (isolate, kill, remove) but often stops short of full forensics, recovery and reporting. Read the MDR contract for "incident response" hours before buying a separate retainer.
- Cyber insurance often gives access to a panel of incident-response firms whose costs the insurer pays under the policy. If you have a policy, using a non-panel firm may affect cover. Check before you sign a retainer with someone else. See cyber insurance basics.
What to ask before signing
- What is the remote and on-site response time, and from what moment?
- Do unused hours roll over, convert to readiness work or expire?
- Are there extra charges for nights, Sundays or festival holidays?
- Who prepares the information for the CERT-In report within six hours? See the CERT-In Directions guide.
- How is evidence preserved if you later need to file a police complaint or claim?
- Does the firm work with your insurer's panel?
- Which tools are deployed during an incident and are they included?
How to size the hours block
A rough way to size a retainer is to estimate the hours a realistic bad incident would take and decide how much of that you want prepaid. As an illustration for a 60-endpoint business hit by ransomware on a few machines:
| Activity | Illustrative hours |
|---|---|
| Triage, scoping and containment | 16 |
| Forensic analysis of affected machines and logs | 40 |
| Recovery support and hardening | 30 |
| Reporting for management, insurer and CERT-In information | 14 |
| Total | 100 |
If your MDR contract already includes, say, 20 response hours, the gap is 80 hours. A 40-hour block covers half of it at the discounted rate; the rest is billed from the rate card. Buy more prepaid hours only if unused hours can be converted into readiness work such as tabletop exercises or compromise assessments, otherwise you are paying for insurance twice.
Readiness: the cheapest hours you will spend
Using part of a retainer for a tabletop exercise once a year tests who calls whom, how quickly decisions are made and whether backups really restore. Many MSMEs discover in such an exercise that nobody knows the admin password for the firewall or that backups are on the same network as the servers.
FAQ
Do small businesses need an IR retainer?
Not always. If MDR includes response hours and you have cyber insurance with a panel, a separate retainer may duplicate cover. If neither applies, a small retainer or a pre-agreed rate card is worth considering.
Can we pay the ransom through the IR firm?
Paying ransoms raises legal, ethical and practical issues and may not restore data. Take legal advice and inform the authorities; do not treat it as a routine service.
How fast can a firm start?
Remote work can often begin within hours under a retainer. Without one, contracting and onboarding can take days.
Sources
- CERT-In — incident reporting and response support
- National Cyber Crime Reporting Portal — reporting cyber crime to police
- IRDAI — insurance regulator, for cyber policies
