How to Choose an Incident Response Firm: The Evaluation That Survives a Claim

Key takeaways

• Evidence beats adjectives. A firm that publishes SLAs, names its bench, and documents its engagements is showing readiness. A firm whose website describes readiness in superlatives is telling you something too.
• Check insurance first if you carry it. Many policies cover panel-firm costs fully. Off-panel work often means pre-approval or partial reimbursement. The panel check comes before the capability comparison.
• The SLA is the product. Availability at your moment of need is what you are buying. A response commitment in the contract is worth more than any case study.
• Certifications are held by people, not firms. Ask which named individuals hold which certifications. Ask whether the firm lets those claims be registry-checked. Firms that resist have usually never been checked.
• Ask everyone the same questions. Five firms answering the same structured questions gives you comparable quotes. Five sales calls give you five decks.

The six checks, in order

1. Insurance panel status (if you carry cyber insurance)

Before comparing capabilities, check whether the firm sits on your carrier's published panel. Panel firms can often bill the carrier directly under the claim. Off-panel firms mean pre-approval, partial reimbursement, or both. Panel relationships are documented on carrier-published pages. The panel checker shows what we document per firm. The panel data study explains what panel presence does and does not prove. No panel presence is not disqualifying. Undisclosed panel rules are.

2. Environment fit

Enterprise Windows estates, cloud-native platforms, and OT/ICS networks fail differently. Responding to one does not qualify a firm for the others. Ask which environments the firm's actual responders have worked in. Not the firm's marketing. The responders. The deep-dives: cloud IR firms and the cloud IR buyer's guide, OT/ICS firms and the OT buyer's guide, plus medtech (FDA 524B) and automotive (UN R155) where regulation shapes the work.

3. Response SLA

What happens in the hours between your call and first responder action is the whole product. Ask for the response commitment in writing: hours to acknowledge, hours to first remote action, hours to on-site where relevant. Ask what happens when the firm is working other incidents at the same time. A firm that cannot answer the concurrency question does not have an SLA. It has a hope. Where firms publish these commitments, the directory documents them. Retainers pre-agree them, which is part of what retainers cost.

4. Certifications, checked at the holder level

Certifications belong to individuals. A firm claiming a "GIAC-certified team" should name the holders and the certificates. A serious firm lets you verify: the GIAC directory lists certified individuals publicly. Our directory pages run registry checks against named holders where they are on record. Ask which certifications map to which roles on your engagement. A bench of incident handlers needs GCFA/GCFE-class forensic certifications. A proposal signed by certified salespeople is not the same thing.

5. Engagement terms

Three structures exist. Per-incident rates. Retainers (access fee, hours bank, or hybrid). And panel terms through an insurer. Compare the same structure across firms, or the numbers mean nothing. The questions that expose the real terms: what rate applies at hour one of a crisis versus hour one of a retainer, what counts as out-of-scope work, who can invoke the agreement, and what the travel and minimum-billing terms are.

6. Documentation discipline

The response has three audiences after the client: the insurer's adjusters, possibly regulators, possibly a court. Ask to see a sanitized sample report. Look for a timeline with evidence citations. Look for scope statements separated from speculation. Look for a structure a non-technical executive could read. This is also the check that predicts the post-incident review. Firms that document well during response give the review real material.

The questions to ask, condensed

1. Who exactly responds to our incident, and what are their certifications, by name?
2. What is your contractual response commitment, and what happens when you are busy?
3. Are you on our carrier's panel, and have you worked claims with them?
4. Have you handled incidents in our environment and sector? Which ones can you describe?
5. How do you handle privilege, and will you work under our counsel's direction? (Why the order matters.)
6. What does your report look like at hour 48, and who has written it?
7. What are the rates, the minimums, and the out-of-scope definitions?

Ask all of them of every firm. The comparison is the deliverable.

Red flags

• No named responders. "Our team" with no people, no certifications by holder, no bench depth.
• SLA vagueness. "We respond immediately" is not an SLA. Neither is a commitment with an asterisk about concurrent incidents.
• Claims without sources. Panel memberships you cannot find on the carrier's page. Certifications with no holder names. Case studies with no sector or scale.
• Environment keyword-stuffing. OT and cloud listed as service lines with no ICS-specific tooling or 62443/CIP fluency behind them.
• Pressure to skip the panel check. Any firm that discourages you from confirming your insurer's reimbursement rules is costing you money.

The process that makes the choice easy

Send the same seven questions to three to five firms. Score the answers, not the salesmanship. That is what the structured RFP builder does: describe your environment once, get responses in a format you can compare, with the firms' documented evidence attached. The directory behind it (start here) carries the evidence tiers. You can see, before you send anything, which firms' claims are registry-checked, panel-documented, or research-sourced.

Frequently asked questions

What should I look for in an incident response firm? In order: panel status against your insurance, environment fit, a contractual response SLA, holder-level certifications, clear engagement terms, and documentation discipline. Evidence for each, not assertions.

Do we need a retainer before we can engage a firm? No. Firms take per-incident work, and panel firms can be engaged through the claim. The retainer buys pre-agreed terms and queue priority. The cost guide explains the structures so you can judge whether the premium is worth it for your risk.

Is the biggest firm the safest choice? Size predicts marketing reach, not response fit. The most panel-documented firms earn that presence, and the 2026 documented ranking shows the top of that distribution. But the long tail contains strong specialists whose fit for your environment beats a generalist's brand.

When should we run this evaluation? Before the incident, ideally alongside the annual plan update. Choosing under fire means choosing from whoever answers the phone. That is the most expensive way to buy anything in security.