The moment ransomware is confirmed is not the moment to evaluate incident response firms. It is the moment to engage the firm you already evaluated and either retained or pre-qualified. The pressure of an active incident, the time required to locate and vet a firm, and the engagement logistics that must complete before response work begins all add hours to the response window that should have been minutes.
But most organizations have not pre-qualified an incident response firm before they need one. They find themselves making the evaluation under exactly the conditions that make it most difficult: during an active crisis, with incomplete information, without time for reference checks or capability assessment, and with the attacker’s deadline manufactured specifically to push decisions before alternatives can be assessed.
This article gives you the specific questions to ask before hiring an incident response team, whether you are doing that evaluation today as preparation or in the middle of an incident because the need has arrived. The questions are organized to reveal genuine capability rather than marketing capability, to expose the gaps that will determine recovery outcomes, and to confirm that the specific firm you are considering can handle the specific incident you are facing.
Use this article to pre-qualify a firm now. Use it to evaluate the firm your insurance carrier refers. Use it if you are in an active incident and need to assess a firm quickly. The questions work in all three contexts because they target the operational reality of what incident response capability actually requires.
The First Category of Questions: Response Speed and Availability
The most time-critical dimension of incident response capability is how fast the firm can be actively working on your incident. The gap between detection and expert engagement is when ransomware continues spreading and when recoverable options become unrecoverable. Questions about response speed reveal whether the firm’s availability matches the operational requirement.
What is your actual response time from first contact to active remote engagement?
The answer should be specific and measured in minutes or hours, not days. Firms with genuine 24/7 capability and pre-established retainer engagement processes should be able to provide active remote support within 30 to 60 minutes of first contact for retainer clients and within one to two hours for cold engagements. Answers that describe business hour availability with on-call escalation for after-hours incidents describe a firm with degraded after-hours response, which is exactly when ransomware operators time their attacks.
Follow-up: is that response time the same at 2am on a Sunday as it is at 2pm on a Tuesday? The answer reveals whether the advertised availability is genuine or whether it degrades outside business hours.
Who specifically will be working on my incident?
The answer should be able to describe specific roles and experience levels, not just team size. A firm with 200 employees but three analysts with ransomware response experience has less relevant capacity than a smaller firm where every analyst has deep incident response experience. Ask whether the analysts assigned to your incident will have ransomware-specific experience or whether your incident might be assigned to someone earlier in their career.
Do you have a retainer program and what does it provide?
Retainer programs pre-establish the engagement terms, commit the firm to response time targets, and in the best arrangements include proactive environmental assessment that produces the environmental documentation the response team uses during an incident. Firms without retainer programs engage every incident as a cold engagement with the discovery overhead that entails. Firms with retainer programs where retainer clients receive meaningfully faster and more environmentally informed response provide more operational value than their nominal response time commitment suggests.
What is your geographic coverage and on-site response capability?
Remote response handles most incident response work effectively. Specific evidence preservation, complex network infrastructure work, and extended recovery operations benefit from on-site presence. The answer should address where the firm’s on-site capable personnel are located relative to your facilities and what realistic on-site travel time is, not just that on-site response is available.
The Second Category: Technical Capability Depth
Response speed without technical depth produces fast engagement of insufficient expertise. Questions about technical capability reveal whether the firm can do the work the incident requires or whether they will be learning on your incident.
How many ransomware incidents have your team members personally responded to in the last 12 months?
The answer should be a specific number, not a general statement about extensive experience. A firm whose analysts handle five to ten ransomware incidents per year has the pattern recognition and technique familiarity that comes from repeated exposure. A firm whose analysts handle one or two per year may provide adequate response but will not have the depth of familiarity that repeated exposure builds. Ask specifically about the analysts who would be assigned to your incident, not the firm’s aggregate experience.
Can you describe the specific phases of your ransomware response methodology?
A firm with genuine ransomware response capability can describe the specific phases of their approach, what happens in each phase, why the sequence is what it is, and what the outputs of each phase are. Firms that describe general incident response categories without ransomware-specific methodology, or that describe phases but cannot explain why threat elimination must precede restoration, are applying general incident response frameworks to a specific problem that requires specific expertise.
What forensic tooling do you use for memory capture and artifact collection?
The answer should name specific tools and explain why they are used for specific evidence types. Firms with genuine forensic capability have specific tool preferences, understand the limitations of different tools, and can explain how their tooling handles edge cases specific to ransomware incidents. Firms that describe forensic capability in general terms without specific tooling knowledge may be describing a capability they have rather than one they exercise regularly.
What is your approach to Active Directory compromise assessment?
Ransomware events with extended dwell periods frequently involve Active Directory compromise through techniques like DCSync, golden ticket attacks, and AdminSDHolder modification. The response team’s capability to identify and remediate AD compromise is one of the most consequential technical capabilities in the recovery process. A firm that can describe specific AD compromise assessment methodology and specific remediation approaches demonstrates the expertise this scenario requires. A firm that describes general malware removal without specific AD assessment capability will miss persistence mechanisms that produce reinfection.
How do you handle double extortion incidents where data exfiltration has occurred?
The answer should address the specific response adaptations that double extortion requires: exfiltration scope assessment, network traffic analysis for exfiltration evidence, breach notification obligation implications, and the management of the publication threat as a track separate from the technical recovery. Firms that address ransomware primarily as an encryption problem without double extortion expertise are missing the response dimension that characterizes most enterprise ransomware events today. Review lessons from recent ransomware breaches to understand how double extortion has evolved across industries.
What is your experience with OT systems in manufacturing environments?
This question is specifically relevant for manufacturing organizations, but it reveals depth of specialization that is instructive even in non-manufacturing contexts. Firms with genuine OT expertise can describe the specific differences between IT and OT incident response, name the OT platforms they have experience with, and explain why OT system restoration requires different procedures than IT system restoration. Firms without OT expertise may be adequate for pure IT environments but represent a risk in manufacturing environments where OT compromise can create safety and operational consequences that IT-trained responders are not equipped to manage.
The Third Category: Industry and Regulatory Expertise
Ransomware response in regulated industries requires expertise that extends beyond technical recovery into regulatory notification frameworks, legal privilege management, and industry-specific recovery sequencing. Questions about industry expertise reveal whether the firm can manage the full response or whether significant gaps will require separate engagement of supplemental expertise.
What regulatory notification frameworks are you familiar with, and specifically which ones apply to our industry?
The answer should be specific to the frameworks applicable to your industry.
- For healthcare organizations, the answer should address HIPAA breach notification including the four-factor risk assessment, the 60-day notification timeline, individual notification requirements, and HHS portal submission.
- For financial services organizations, the answer should address FFIEC, SEC, DFS, and GLBA notification frameworks with the specific timelines and content requirements for each.
- For defense contractors, the answer should address DFARS 252.204-7012 reporting requirements, the 72-hour timeline, DIBNet submission, and the system image preservation requirement. Organizations pursuing CMMC compliance have additional documentation obligations that the firm must understand.
Firms that describe regulatory notification in general terms without framework-specific knowledge will require supplemental legal expertise that a more experienced firm would integrate directly. That is not disqualifying, but it affects how you structure the engagement and what you should expect the firm to manage directly versus what requires separate legal coordination.
What is your approach to protecting investigation findings through attorney-client privilege?
The answer should address whether the firm structures its investigations under outside counsel direction as anticipated litigation work product, whether it has experience with the privilege structuring process, and whether it understands the distinction between facts that must be disclosed to regulators and analysis that may be protected. Firms that are unfamiliar with privilege structuring will not proactively build that protection into the engagement, which leaves investigation findings unprotected from discovery in regulatory proceedings and litigation.
Have you responded to incidents at organizations in our specific industry?
The answer should be specific, not general.
- Healthcare incident response requires clinical system recovery sequencing knowledge and downtime procedure integration.
- Financial services incident response requires regulatory notification integration and transaction processing continuity management.
- Manufacturing incident response requires OT system expertise and production continuity management.
- Law firm incident response requires privileged data handling protocols and professional responsibility awareness.
Firms with industry-specific experience apply that knowledge from the beginning of the engagement. Firms without it reconstruct it during your incident.
Can you provide references from clients in our industry who have experienced ransomware incidents?
References from actual incident clients are the most reliable indicator of real-world performance. Ask specifically for references from incidents rather than from general client relationships, because incident performance reveals the pressure-tested capability that general client satisfaction does not. Ask whether you can speak directly with the client’s CISO or IT lead who managed the incident, not a marketing contact.
The Fourth Category: Insurance Integration and Coordination
For organizations with cyber insurance, the incident response firm’s ability to integrate with the insurance process affects both the coverage available and the coordination efficiency of the response. Questions about insurance integration reveal whether the firm understands and operates within this context.
Are you on the approved vendor panels for major cyber insurance carriers?
The answer should name specific carriers whose approved panels the firm is on. Firms on approved panels have pre-negotiated rates that the carrier will reimburse and have confirmed coverage authorization that does not require per-incident approval negotiation. Firms not on approved panels may still be engageable with carrier authorization, but the coverage is less certain and the engagement process is more complex.
What is your process for working with the breach coach provided by the insurance carrier?
The answer should describe a collaborative process where the breach coach manages legal and regulatory coordination while the incident response firm manages technical response, with defined communication protocols between the two. Firms that have not worked frequently with breach coaches may create coordination friction that slows the response and creates gaps between technical findings and legal response.
How do you document costs for insurance claim support?
The answer should describe specific cost documentation practices: contemporaneous time records for all response activities, vendor invoice preservation, documentation that connects each cost to the specific covered incident, and the format in which documentation is organized for claim submission. Firms with mature claim support documentation practices reduce the administrative burden on the client during the claim process and reduce the probability of coverage disputes about whether specific costs were reasonable and necessary.
The Fifth Category: Post-Incident Deliverables and Hardening
The value of an incident response engagement extends beyond the immediate recovery to the findings and recommendations that drive post-incident security improvement. Questions about post-incident deliverables reveal whether the firm’s engagement produces lasting value or just immediate recovery.
What does the incident report you produce contain, and what can clients do with it?
The answer should describe specific report contents: the complete attack timeline, the specific entry point identified, the lateral movement reconstruction, the data access and exfiltration assessment, the persistence mechanisms identified and remediated, and the specific security gap analysis with targeted recommendations. Firms that produce detailed investigation reports with specific, actionable findings create more post-incident value than those that produce summary documents that describe what happened without identifying why.
What is your approach to post-incident hardening recommendations?
The answer should describe recommendations that are specific to the investigation findings rather than generic security framework improvements. A firm that recommends implementing MFA because it is a generally important control is providing general security advice. A firm that recommends implementing MFA specifically because the investigation identified that credential-based RDP access was the entry point and that MFA would have prevented that specific access path is providing incident-specific advice that addresses the actual gap. Review multi-factor authentication services that address credential-based attack vectors directly.
Do you provide any ongoing support after the initial engagement concludes?
The answer reveals whether the firm views their relationship with clients as transactional or ongoing. Firms that provide post-engagement support for questions arising from the investigation findings, assistance with implementing specific hardening recommendations, and follow-up assessment after remediation completion treat the engagement as the beginning of an improved security posture rather than the resolution of an incident.
The Sixth Category: Cost Structure and Engagement Terms
Understanding how the firm charges and what the engagement terms are prevents surprises that complicate decision-making during an active incident.
What is your billing structure for emergency engagements?
The answer should specify whether billing is hourly, daily, by phase, or through a retainer structure. For emergency engagements without a retainer, understand whether there is a minimum engagement commitment, what the initial deposit or retainer requirement is, and what the billing cycle is for an engagement that may span multiple weeks.
What is your estimate of costs for an incident of our size and complexity?
The answer will necessarily be a range because the actual cost depends on investigation findings. A firm that provides a specific number without knowing the incident scope is providing a marketing estimate rather than an operational one. A firm that provides a range tied to specific factors, such as environment size, infection scope, and investigation depth, demonstrates the engagement experience to understand what drives cost.
What are your conflict of interest policies for simultaneous client engagements?
During a major ransomware campaign affecting multiple organizations simultaneously, incident response firms may have multiple active engagements in the same industry. Understanding the firm’s policies for managing resource allocation and information separation between concurrent engagements is relevant to whether your incident will receive adequate attention and whether investigation findings from your incident will be appropriately protected from disclosure to other clients.
The Questions to Ask Yourself Before the Incident Arrives
The questions above are for evaluating an incident response firm. These final questions are for evaluating your own readiness to engage one effectively when you need it.
- Do you have cyber insurance and do you know the conditions that coverage requires for incident response vendor engagement? If your insurance requires using an approved panel vendor and you have pre-qualified a firm that is not on the panel, you have a coverage gap that pre-incident coordination can resolve.
- Have you informed your incident response firm about your environment before an incident? The environmental documentation that accelerates the firm’s response, network architecture, backup infrastructure, system inventory, and critical system dependencies, can be shared with a retainer firm before an incident so they are working from knowledge rather than discovery when the incident arrives. A current IT risk assessment gives the incident response firm the environmental context they need before they ever receive an emergency call.
- Do the people who will make the engagement decision during an incident know the firm exists and how to reach them? The emergency contact information for the incident response firm must be accessible to the people who will make the call at 2am, not stored only in the IT lead’s head or in a production system that may be encrypted.
- Have you verified that the firm you pre-qualified is still on your current cyber insurance carrier’s approved panel? Insurance policies renew and approved vendor panels change. The firm that was on the approved panel when you pre-qualified them may not be on the panel when the incident occurs if the policy has renewed with a different carrier or if the carrier has updated its panel.
Meet Our CEO, Matt Rosenthal
With more than 30 years of experience in business and technology leadership, Matt Rosenthal has guided organizations across healthcare, finance, legal, manufacturing, and defense through the process of evaluating and engaging incident response firms both before incidents as preparation and during incidents under pressure. As President and CEO of Mindcore Technologies, Matt leads a team that provides cybersecurity services and managed IT services with the incident response capability and established vendor relationships that make pre-qualified expert engagement possible from the first minutes of an incident.
Matt’s approach to incident response firm evaluation is grounded in the recognition that the evaluation done before an incident is thorough and produces confidence. The evaluation done during an incident is rushed and produces uncertainty. The difference between those two experiences is a preparation decision made before the incident makes the evaluation urgent.
Frequently Asked Questions
How do we pre-qualify an incident response firm without experiencing an incident?
Request a capabilities presentation that addresses each of the question categories in this article. Ask for references from incident clients in your industry and contact those references directly. Review the firm’s retainer agreement terms to understand what the retainer provides and what it commits the firm to. Ask the firm to conduct an environmental assessment of your infrastructure as part of the retainer relationship so they have documented knowledge of your environment before an incident requires them to work in it.
Should we pre-qualify multiple firms or commit to one?
Pre-qualifying one firm and establishing a retainer relationship with them produces better outcomes than maintaining multiple pre-qualified relationships. A retainer relationship with one firm produces environmental familiarity, established engagement terms, and committed response time targets. Multiple pre-qualified relationships without retainers produce options but not commitments. For organizations with specific needs that one firm cannot fully address, such as OT-specialist capability combined with forensic depth, a primary retainer firm with a documented referral relationship for specialized capabilities may be the appropriate structure.
What if the firm referred by our insurance carrier is not one we would have chosen?
Engage the carrier-referred firm for covered costs while simultaneously evaluating whether supplemental engagement of your preferred firm for specific capabilities not provided by the referred firm is appropriate. Communicate with the breach coach about the capability gaps you perceive and whether alternative approved vendors or specific authorized out-of-panel engagements can address them. Do not unilaterally engage unapproved vendors and expect coverage.
How often should we re-evaluate our pre-qualified incident response relationship?
Re-evaluate annually as part of the incident response plan review process. Key evaluation triggers include: personnel changes at the incident response firm that affect the analysts who would be assigned to your incident, changes to your cyber insurance carrier or approved vendor panel, significant changes to your environment that the firm’s documentation no longer reflects, and any actual incident engagement that revealed capability gaps.
Does having a pre-qualified incident response firm mean we do not need managed IT security services?
They address different needs. A pre-qualified incident response firm provides expert resources that engage when an incident occurs. Managed IT security services with continuous monitoring provide the detection capability that identifies incidents before they become enterprise-wide encryption events. Both are needed. The detection capability reduces the probability and scope of incidents. The incident response relationship ensures that when an incident occurs despite detection, expert help is available within minutes rather than hours.
Evaluate Now So You Are Not Evaluating During the Incident
The questions in this article take an afternoon to ask and an afternoon to evaluate the answers. The evaluation done today produces a pre-qualified relationship with a firm whose capability you have confirmed, whose contact information is in your incident response plan, and who has documented knowledge of your environment.
The evaluation done during an active incident under attacker time pressure produces an uncertain engagement with unknown capability gaps and a response that begins hours later than a pre-established relationship would have enabled.
The investment is an afternoon. The alternative is the most expensive afternoon of your organization’s recent history.
Mindcore’s cybersecurity services and managed IT services provide organizations across healthcare, finance, legal, manufacturing, and defense with the incident response capability, established vendor relationships, and pre-incident evaluation support that make expert engagement a planned response rather than a crisis search. If your organization has not pre-qualified an incident response relationship, contact Mindcore to begin that evaluation before an incident makes it urgent.
