An incident response retainer works by providing a structured agreement between an organization and a security services provider. One type of option is a no-cost retainer in which a service provider outlines how they will help the organization respond to an incident, in the event of one occurring. Another type is a prepaid retainer where the organization pays in advance for an agreed number of hours, which can be used to respond to cyber incidents. At Kroll, we provide incident response retainers that allow companies to achieve the greatest impact with highest level of flexibility.