1-Hour Incident Commander Dispatch. Guaranteed.
Forensic readiness for regulated enterprises. A senior incident commander is directing containment inside your environment within 60 minutes of severity declaration — sourced from the first volatile byte, before evidence decays and before your statutory reporting clock runs out.
Outcome retainer — never billed by the hour
This is a standby outcome retainer. You buy guaranteed readiness and guaranteed dispatch — not an hourly meter that rewards slow resolution. Standby readiness hours are an internal capacity guardrail that protects you from scope creep; they are never presented to you as a billable rate.
- Guaranteed 60-minute incident commander dispatch
- Volatility memory & EVTX/SIEM forensics
- Court-defensible forensic binder
- Statutory filing drafts (DORA / NIS2 / SEC / HIPAA / PIPEDA)
Canadian domestic rate: $4,375 CAD per month at the fixed 1.25 conversion.
- Twelve months of standby coverage, paid upfront
- Same guaranteed 60-minute dispatch
- Quarterly readiness drills included
- Equivalent to the monthly rate — no uplift
$42,000 USD or $52,500 CAD per year.
Published rates: $3,500 USD per month (equivalent to $4,375 CAD per month at the fixed 1.25 CAD-per-USD sovereign rate), or $42,000 USD per year paid upfront (equivalent to $52,500 CAD per year).
Dispatch targets by severity
Dispatch is measured from the moment severity is declared and acknowledged. P1 and P2 run continuously; P3 and P4 burn business hours in your jurisdiction.
| Severity | Trigger condition | Dispatch target | Coverage window |
|---|---|---|---|
| P1 | Active intrusion or confirmed data exfiltration | 60 minutes | 24x7x365 |
| P2 | Confirmed compromise, containment underway | 60 minutes | 24x7x365 |
| P3 | Suspected compromise or unverified lateral movement | 4 business hours | Business hours (Mon–Fri, 09:00–18:00 local) |
| P4 | Advisory, readiness review, or forensic consult request | 1 business day | Business hours (Mon–Fri, 09:00–18:00 local) |
Regulated-sector promotion rule
If you operate in healthcare, financial services, or critical infrastructure, your coverage runs 24x7x365 at every severity level, P1 through P4. Statutory filing clocks start at discovery — not when your business day begins — so we do not let a P3 wait until Monday morning.
Your filing deadline is already running
Every window below is measured from discovery, not from the moment you engage counsel or call us. This is why standby exists.
| Regulation | Jurisdiction | Filing window | Clock starts |
|---|---|---|---|
| DORA | European Union | 4 hours — initial notification of a major ICT incident | Discovery |
| NIS2 | European Union | 24 hours — early warning to the CSIRT | Discovery |
| SEC Form 8-K | United States | 4 business days — material cybersecurity incident disclosure | Discovery |
| HIPAA | United States | 60 days — breach notification | Discovery |
| PIPEDA | Canada | 72 hours — report to the OPC where there is a real risk of significant harm | Discovery |
A 4-hour DORA notification is not a documentation exercise. It requires a defensible account of what was touched, what was exfiltrated, and what you did about it — which is only possible if volatile memory was captured before it decayed.
What you actually receive
Every artifact below is admissible-grade: reproducible, hashed, and independently verifiable.
Volatility memory forensics
Live memory acquisition and structured analysis of running processes, injected code, network connections, and credential material — the only evidence that vanishes on reboot.
EVTX & SIEM compromise analysis
Windows event log reconstruction and SIEM correlation to establish initial access, lateral movement, persistence, and the true blast radius — not just the alert that fired.
Court-defensible forensic binder
An 11-section investigative record with documented chain of custody and SHA-256 dual-hash discipline applied at acquisition, at transfer, and at analysis.
Statutory filing drafts
Pre-drafted regulatory notifications for DORA, NIS2, SEC Form 8-K, HIPAA, and PIPEDA, written to the evidentiary standard each regulator actually expects.
Standby, and what happens when it escalates
Your retainer includes a fixed standby readiness allocation. When a real incident runs long, you are not renegotiating a contract at 3am.
| Element | Included in the retainer |
|---|---|
| Standby readiness | 10 standby readiness hours per month, held as an internal capacity guardrail so your named incident commander is genuinely available rather than nominally on call |
| Active surge capacity | Pre-agreed active surge capacity for a live incident, engaged on your authorization and governed by the same fixed terms — no emergency procurement, no hourly meter surprise |
| Dispatch guarantee | 60 minutes for P1 and P2, running 24x7x365, with 24x7 coverage at all severities for regulated sectors |
| Direct commander line | Direct escalation path to your incident commander, led by practice leadership with UC Berkeley cybersecurity credentials and former KPMG Cyber & Forensics investigation experience |
Request Standby Coverage
Tell us your sector, your regulatory exposure, and your current detection stack. We will confirm eligibility, scope the standby arrangement, and issue the agreement — before you need it.
Or compare every package on the retainer index.