Skip to main content
← All controls
IR-7 / A.16.1.5 NIST SP 800-61 Rev 2

Do you have an external IR / forensics firm pre-engaged on retainer with a tested escalation path?

Demonstrate that the organization maintains an active retainer agreement with a qualified external IR/forensics provider and has validated the escalation and engagement procedures through documented testing.

Description

What this control does

This control ensures the organization has a pre-established contractual relationship with an external incident response and digital forensics firm, including defined escalation procedures and communication channels that have been tested through tabletop exercises or simulations. The retainer agreement should specify response time commitments, available resources, and financial terms to enable rapid mobilization during a security incident. This arrangement eliminates procurement delays during crisis situations and ensures specialized expertise is immediately accessible when internal capabilities are insufficient for sophisticated attacks or large-scale breaches.

Control objective

What auditing this proves

Demonstrate that the organization maintains an active retainer agreement with a qualified external IR/forensics provider and has validated the escalation and engagement procedures through documented testing.

Associated risks

Risks this control addresses

  • Critical delays in incident response due to procurement processes during active security incidents, allowing attackers extended dwell time to exfiltrate data or establish persistence
  • Inability to secure specialized forensics expertise during widespread security events when external firms are at capacity and prioritizing existing retainer clients
  • Evidence spoliation or improper handling of digital artifacts by untrained internal staff attempting forensics without expert guidance, rendering evidence inadmissible or incomplete
  • Escalation confusion during high-stress incidents causing miscommunication, missed notification windows, or failure to activate external resources when needed
  • Insufficient internal capability to analyze advanced persistent threats, nation-state attacks, or sophisticated malware requiring specialized reverse engineering and threat intelligence
  • Regulatory non-compliance due to inadequate forensic investigation capabilities for breach notification requirements under GDPR, HIPAA, or state data breach laws
  • Loss of legal privilege protections when incident response is not conducted under attorney-client privilege frameworks that external firms typically provide through legal counsel engagement

Testing procedure

How an auditor verifies this control

  1. Request and review the current retainer agreement with the external IR/forensics firm, verifying active status, renewal dates, and scope of services covered
  2. Verify the agreement specifies maximum response times, resource commitments, on-call availability, and financial terms including retainer fees and incident-based billing structures
  3. Obtain and examine documented escalation procedures including primary and secondary contact lists with names, roles, phone numbers, email addresses, and secure communication channels
  4. Review meeting minutes, tabletop exercise reports, or simulation documentation demonstrating the escalation path has been tested within the past 12 months
  5. Interview incident response team members to confirm familiarity with escalation procedures, contact information accessibility, and criteria for external firm activation
  6. Examine incident response playbooks or runbooks to verify integration points where external firm engagement is documented as a defined step for specific incident types or severity levels
  7. Request evidence of recent communication with the retainer firm such as quarterly check-in meetings, retainer status confirmations, or updates to contact information within the past 90 days
  8. Review any actual incident records where the external firm was engaged to assess whether escalation occurred according to documented procedures and response times met contractual commitments
Evidence required Collect the executed retainer agreement with service level specifications, documented escalation contact lists maintained in the incident response plan or knowledge base, and records of escalation testing such as tabletop exercise after-action reports, test invocation logs, or drill documentation. Obtain screenshots or exports of where escalation procedures are documented in IR playbooks, and copies of recent communications with the retainer firm including quarterly review meeting notes or status confirmations.
Pass criteria The control passes if an active retainer agreement exists with defined response times and services, documented escalation procedures are maintained and accessible to the IR team, and evidence demonstrates the escalation path was tested through exercise or drill within the past 12 months.