Choosing a crisis response firm for a cyber incident: what to check before you sign
Quick answer, Nov 1, 2026As of 1 November 2026, picking a crisis response firm for a cyber incident is six checks run in advance: accreditation against a published standard, who signs the engagement, the response clock in the retainer, evidence handling, which reports the firm supports, and a sanctions screen on the firm itself. Run them before an incident.
The six checks
| Check | What to ask for | Where the standard comes from |
|---|---|---|
| Accreditation | Current assurance against a published incident-response standard, with the certificate and its scope | NCSC assured Cyber Incident Response, CREST, PCI Forensic Investigator |
| Who signs | The engagement letter, and whether counsel or the company holds it | Your counsel and your cyber policy |
| The clock | A response SLA in hours, named leads, out-of-hours cover, an hours bank | The retainer |
| Evidence | Chain of custody, acquisition method, where images are stored and for how long | NIST SP 800-86 (August 2006) |
| Reporting | What the firm will produce for the FBI, CISA and, for a public company, an Item 1.05 filing | IC3, CISA, SEC Item 1.05 |
| Sanctions | A screen on the firm, its owners and any local subcontractor | OFAC |
The accreditations that exist
Three are published, checkable and open to a commercial buyer.
- NCSC assured Cyber Incident Response. The UK National Cyber Security Centre assures providers at two levels, Enhanced and Standard, against its CIR Technical Standards, and says it "recommends that all UK organisations should use an NCSC-assured Cyber Incident Response provider when dealing with cyber incidents." The assured providers are listed by the NCSC.
- CREST. CREST publishes accreditation standards covering organisational requirements and specific services, incident response among them, and accredits companies against them. It also runs the NCSC scheme above: CREST describes itself as "a Delivery Partner operating the scheme on behalf of the NCSC" and says Assured Service Provider status "will last for 12 months and is renewed annually," with a full renewal every three years.
- PCI Forensic Investigator. Where payment-card data is in scope, the PCI Security Standards Council qualifies investigators who "must currently work for an active and approved PFI Company", and says "all PFIs must requalify annually." The Council publishes the list of PFI companies and states on it that the Council "does not endorse these providers or their business processes or practices."
The US federal picture is different, and a US credential needs reading closely.
- NSA NSCAP is scoped to national security systems and closed to new applicants. The one US federal accreditation of incident-response firms in the public record is the National Security Cyber Assistance Program's Cyber Incident Response Assistance accreditation, for providers serving owners of national security systems. NSA has announced "a temporary hold to the NSCAP accreditation program" and says it is "not accepting new Cyber Incident Response Assistance (CIRA) or Vulnerability Assessment Service (VAS) applications" (NSA page, archived 19 April 2026).
- GSA HACS is a procurement vehicle, not an accreditation. Incident Response is one subcategory of special item number 54151HACS on GSA's Multiple Award Schedule, and GSA states that "All vendors must pass an oral-technical evaluation before they can be awarded the HACS SIN." That qualifies a firm to sell to federal agencies. Read it as a contracting route, not as an assurance mark a commercial buyer can rely on.
- CISA and NIST do not accredit firms. CISA's published role is taking reports and publishing guidance, including the #StopRansomware Guide. NIST publishes the method: NIST SP 800-61 Rev. 3 (April 2025) is the current NIST incident-response publication and is written as a CSF 2.0 community profile. Ask which named framework the firm's own methodology maps to.
Who signs the engagement
Settle this before the incident, not during it.
- Counsel or the company. Where the engagement runs through outside counsel, the firm works to counsel's instructions. A court can still order a forensic report produced, so counsel decides what the firm writes and who receives it.
- The insurer. Cyber policies carry panel lists and consent clauses. Calling a firm that is not on the panel, or starting work before consent, can put the claim at risk. Read the clause now and, if your preferred firm is off-panel, ask the insurer to add it before you need it.
- The deliverable. Agree what the report says, who gets it and in what order: counsel, insurer, board, regulator.
Fix the retainer terms in advance
Name the response SLA in hours and whether it holds at 3am on a holiday. Name the people, not just the firm. Agree rates, any pre-paid hours and what they convert to if unused. Say where images and logs are stored, under whose jurisdiction, and when they are destroyed. List any subcontractors by name and country, because each one is a separate screening job.
The sanctions screen runs on the firm too
Screen the firm, its owners and its subcontractors against the US lists before signing, the same way you would any counterparty. See How to screen a counterparty against OFAC lists.
If the incident turns into a payment question, the sanctions analysis is separate and it is strict: OFAC's updated ransomware advisory sets out the sanctions risks of facilitating a ransomware payment and the mitigating factors it would weigh in an enforcement action. The sequence for the first three days is in First 72 hours after ransomware.
An AI assistant can run the sanctions and reporting parts of this against the official record through the Distributed Risk MCP server: search_screening_lists for the lists, list_ofac_actions for recent designations, and list_cyber_incident_filings for Item 1.05 disclosures already on EDGAR.
When the incident is not only digital
Extortion with a named victim, a leak site counting down, staff exposed in a country where the record is thin: that is a crisis response job as much as a forensics job. Brief an advisor and we arrange the firm with people in that country, make the introduction and stay your contact through the response.
Questions
Does the insurer choose the firm? Usually it constrains the choice. Most cyber policies name a panel and require consent before costs are incurred. Check the clause before the incident, not after.
Does accreditation guarantee quality? No. It confirms a firm was assessed against a published standard at a point in time. Ask for the certificate, its date and its scope, and ask who on the named team actually holds the credentials.
Is this legal advice? No. This page is a procedural checklist drawn from the public record. Counsel and your insurer decide what applies to your incident.