Testing the Response Retainer Before You Need It

Somewhere in the response plan is a phone number for an incident response retainer. It was signed eighteen months ago. Nobody has dialed it since.

A retainer you have never called is not a capability; it is a hypothesis about a capability. You do not know how the firm answers, who picks up, what they ask for, or how fast a qualified person actually joins your call. A real incident is a terrible time to run that experiment.

One structured test call a year turns the hypothesis into knowledge - and often pays for itself in the first ten minutes.

TLDR

• Call the retainer line once a year as a drill, with the firm's knowledge.

• Time everything: answer, triage, and a qualified responder on the line.

• Verify they know who you are: contract on file, contacts current, terms reachable.

• Rehearse your side too - who calls, what they say, what they are asked for.

• Log the results and fix what failed, exactly like a technical test.

What a test call reveals

Teams that run a first test call usually learn at least one expensive thing cheaply. The retainer line routes to a generic intake desk that has never heard of your company. The named contacts left the firm last year. The after-hours path is an answering service with a four-hour callback. The engagement letter requires a signature from someone who is unreachable on weekends.

None of these are breaches of contract; they are ordinary drift. They are also exactly the details that decide whether hour one of a real incident is productive or spent on hold.

Run it like a drill, not a surprise

Tell the firm you are scheduling a test - most good providers welcome it, and some build it into the retainer. Agree the scenario: a realistic declaration call, run at a realistic hour, timed and logged.

This fictional example shows a test record. It is an illustration, not a real log.

Checkpoint	Target	Actual	Note
Line answered by a human	5 min	3 min	Intake desk, courteous
Correct account located	10 min	22 min	Contract under old company name
Qualified responder on call	60 min	75 min	Escalation took one extra hop
Engagement paperwork ready	Same day	Same day	Pre-agreed template worked

Run your side of the call too: who dials, what they declare, what facts they have ready. The firm's intake questions - environment size, affected systems, what you have done so far - are a free checklist for your own first-hour playbook.

Fix and re-verify

Every miss gets an owner and a date, same as a technical finding. The common fixes cost nothing: updated contacts on both sides, the contract findable under the right entity name, a copy of the engagement letter where the on-call person can reach it, a second firm identified if the primary is ever engaged elsewhere.

Then verify at the next drill. A fix you have not re-tested is still a hypothesis.

Fold it into the exercise calendar

The retainer test pairs naturally with the annual tabletop: run the scenario, then make the call as part of the exercise. Your team rehearses the declaration, the firm rehearses the intake, and the response plan gains a realistic first hour instead of an assumed one.

Contingency guidance from NIST has always put testing at the center of readiness. A phone number is a plan element; a tested phone number is a capability.

The related discussion of building a resilient incident response program is worth your time alongside this one.

Frequently asked questions

Will the firm charge for a test call?

Most retainers include some form of onboarding or periodic check, and many firms treat a scheduled drill as normal relationship maintenance. Ask - if the retainer makes a test call awkward, that is worth knowing before the real one.

How often should we test?

Once a year at minimum, plus after any change on either side: new account manager, new contract terms, a reorganization on yours. Contacts drift faster than annual.

What if we have no retainer at all?

Then the test is different but still runnable: decide today who you would call, and confirm they would take you as a client mid-incident. 'We will find someone during the crisis' is the most expensive retainer there is.

A Defensible Next Step

Find your retainer's phone number and call it this quarter as a scheduled drill. The three surprises you find now are the three delays you will not have during the real thing. Book a Decision-Clarity Call if you want a drill script.