Incident Response Services: How to Select and Contract a Provider in Australia

Incident response services are bought in calm conditions and judged in a crisis. The practical question is not which provider has the most impressive credentials. It is whether the provider will answer the phone at 2am on a public holiday, start work without a new contract negotiation, and have people with the right skills available in the right place. Those things are decided in the retainer, before an incident.

CYBORIUM helps Australian organisations compare incident response providers through a structured vendor-neutral sourcing process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the service.

Define what you need the provider to do

Response work covers several distinct skills: triage and scoping, digital forensics, containment and eradication support, recovery, threat actor communication in ransomware cases, and help preparing regulatory and customer notifications. Few organisations need a provider to do all of these with its own staff. Decide which the internal team, the managed security provider, legal counsel and the insurer’s panel will cover, and which must come from the response provider.

Check the insurance policy early. Many cyber policies require or encourage the use of panel providers. Selecting a provider outside the panel without agreement can affect what is covered.

Five areas that decide incident response value

1. Response commitment

Ask for contractual response times, not typical ones. Separate the time to acknowledge, the time to have an analyst working on the case and the time to have someone on site if needed. Confirm how on-site attendance works for your locations in Australia.

2. Capability and capacity

Ask how many responders the provider has available in Australia, which skills they hold and how the provider handles several clients with major incidents at the same time. A provider that relies on overseas teams may still be a good choice, but you need to know which work happens where and what data leaves the country.

3. Regulatory and notification support

Australian obligations can run in parallel. The Notifiable Data Breaches scheme requires an assessment of a suspected eligible data breach within 30 days. APRA CPS 234 requires regulated entities to notify APRA within 72 hours of becoming aware of a material information security incident. Critical infrastructure assets under the SOCI Act have their own reporting timelines, and many businesses must report ransomware payments under the Cyber Security Act 2024. Ask how the provider supports the evidence and timeline for each. The obligation stays with the organisation.

4. Forensic evidence handling

Ask how evidence is collected, preserved and documented, and whether the provider’s work has been relied on in legal or insurance proceedings. Confirm whether the engagement can be run through legal counsel where privilege matters.

5. Retainer commercial model

Retainers vary. Some prepay a block of hours that can be used for preparation work if no incident occurs. Others charge a standby fee with incident hours billed separately. Compare rates, minimum commitments, what happens to unused hours and whether surge pricing applies during a major event.

Use preparation work to test the provider

A retainer that includes unused hours can pay for a tabletop exercise, a review of the incident response plan or a compromise assessment. These are useful in their own right, and they show how the provider works before a real incident. Treat the first exercise as part of the evaluation of the relationship.

A comparable evaluation

Give each shortlisted provider the same scenario, such as ransomware affecting a file server and a cloud identity provider over a weekend, and ask for a written account of their first 24 hours. Score the response on actions, roles, communication and evidence handling. Add written evidence on response commitments, local capacity, insurance panel status, data handling and three commercial scenarios: no incident, one moderate incident and one major incident.

Contract points to settle

The retainer should state response commitments, the scope of included services, how hours are drawn down, rates for work outside the retainer, confidentiality, handling and return of evidence, use of subcontractors and where data is processed. Pre-agree the statement of work template so an incident does not start with a contract negotiation.

CYBORIUM’s role in the decision

CYBORIUM can define the response scope, align it with insurance and internal roles, prepare the scenario, coordinate providers, evaluate responses and compare retainer models. The organisation keeps the decision and contracts directly with the selected provider. The guide to backup and recovery procurement covers the recovery side of the same risk.

Updated 15 September 2026. This guide explains CYBORIUM’s procurement evaluation method. It does not provide legal or regulatory advice.

Standards and further reading

Incident response is contracted before it is needed and judged afterwards. These set the expectations you should write into the agreement now.

• NIST SP 800-61 Rev. 3. The response lifecycle a retainer should cover end to end. Check which phases the provider actually staffs rather than advises on.
• ASD incident response guidance. Australian guidance on planning and running a response, including reporting obligations that a provider does not discharge for you.
• ASD Annual Cyber Threat Report. Reported incident volumes and costs, useful for sizing a retainer against a realistic frequency rather than a worst case.

Also relevant: the Australian telecommunications industry outlook, and backup and recovery procurement, and responding in control-system environments.

Last updated: 22 October 2026