Choosing an incident-response firm
Draft: pending legal review.
We don\u2019t list or recommend incident-response firms. InventiveHQ, which publishes this site, is one provider of such services, so we point you to neutral sources instead.
What the guidance says
NIST SP 800-61r3: third parties and contracted incident handlers
NIST (US Dept. of Commerce)
NIST's April 2025 incident response profile says an organization's incident handlers may be on staff, on contract (e.g. an MSSP or a cloud provider's response team), or available when needed (e.g. from a cybersecurity services provider). Section 2.2 says third parties under contract share responsibility, so the contract should define responsibilities, information flows, coordination and authority to act, plus limits on what the provider may do (e.g. sharing sanitized incident data with other customers, or taking operational decisions such as deactivating services). It also notes providers often have privileged access to systems and sensitive data, so insider and provider-compromise risk should be addressed, with NDAs and contract clauses named as options.
- NIST SP 800-61r3 (PDF), Section 2.2 Incident Response Roles and Responsibilities
- NIST CSRC publication page (final, April 2025)
Some details couldn't be verified. Confirm on the official page.
FTC: Data Breach Response, A Guide for Business (forensics team)
Federal Trade Commission
Under 'Secure Your Operations' the FTC guide tells businesses to assemble a team of experts and to identify a data forensics team, considering independent forensic investigators to find the source and scope of the breach, and to consult legal counsel (possibly outside counsel with privacy expertise). Under 'Fix Vulnerabilities' it says to work with the forensics experts and act promptly on their reports. The page printed date is August 2023. It does not mention cyber insurance.
Some details couldn't be verified. Confirm on the official page.
CISA Incident Response Plan (IRP) Basics
CISA
CISA's IRP Basics fact sheet advises reviewing the plan with an attorney and notes that attorneys often have preferences on how to engage outside incident response vendors, law enforcement and other stakeholders. This supports engaging a firm through counsel when counsel wants that.
Some details couldn't be verified. Confirm on the official page.
CISA: Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches
CISA
In the response checklist CISA says to engage internal and external teams and to strongly consider requesting help from a reputable third-party incident response provider with data-breach experience. It does not name or list providers.
Some details couldn't be verified. Confirm on the official page.
CISA #StopRansomware Guide: engaging outside parties
CISA (with MS-ISAC)
The guide says to engage internal and external teams, naming IT, managed security service providers and the cyber insurer as contacts to fill in ahead of time, notes that federal agencies can voluntarily help determine the extent of a compromise, and recommends contract language to formalize security requirements with MSPs.
Some details couldn't be verified. Confirm on the official page.
SBA page on engaging forensic experts
U.S. Small Business Administration
No SBA page saying to engage forensic experts was found. The guessed URLs sba.gov/blog/what-do-if-your-small-business-suffers-data-breach and sba.gov/business-guide/manage-your-business/cybersecurity returned HTTP 404. Do not cite SBA for this point.
Some details couldn't be verified. Confirm on the official page.
When and how a PFI is engaged (acquirer and card brands)
PCI Security Standards Council
The PFI Program Guide (v3.2r1, Nov 2021) says that after a security issue an entity may be required under industry rules to notify its acquiring bank and/or affected payment brands and to engage a PCI SSC-qualified PFI. The Council's 'Responding to a Cardholder Data Breach' guidance says acquirers and brands each have their own thresholds for when a PFI must be engaged, so contact them to decide; only PFIs listed on the Council site are approved for card breach investigations; some PFIs offer retainers; PFIs must be independent (your QSA firm cannot be your PFI); PFIs must be able to start within five business days of signing; the brands may also engage a PFI directly (Program Guide).
- PCI SSC PFI Program Guide v3.2r1 (PDF), Section 1.1 Background
- PCI SSC Responding to a Cardholder Data Breach (PDF), 'Engaging a PFI'
Some details couldn't be verified. Confirm on the official page.
Official lists and programs
These are run by standards bodies or agencies. Availability and eligibility vary, so check each one.
CISA Cyber Incident Response service
CISA
CISA's own incident response and coordination service is described for critical infrastructure sectors and federal, state, local, tribal and territorial government entities, with remote and on-site engagement types. The page does not state eligibility rules, cost, or a request process, and does not list or accredit commercial providers. CISA's small and medium business page points to a no-cost services repository and regional Cybersecurity Advisors, and to the 'Report a Cyber Issue' form.
Some details couldn't be verified. Confirm on the official page.
PCI SSC list of PCI Forensic Investigators (PFI)
PCI Security Standards Council
Public, free directory on the Council's site of forensic firms qualified under the PFI program for payment card breaches. Filters: place of business, language, region and servicing country (markets such as AP, CEMEA, LAC); click a company for details; an 'Export List' option exists. 'In Remediation' marks PFIs in the PFI Remediation Program that may still perform investigations. PFIs must work for a Qualified Security Assessor company with a dedicated forensic practice. The page says clients should confirm status each time they engage a PFI, that the list is updated frequently and may not be current, and that qualification is not an endorsement of the provider's business practices.
Some details couldn't be verified. Confirm on the official page.
NSA National Security Cyber Assistance Program (NSCAP)
National Security Agency
NSA ran an accreditation program for commercial incident response providers; a search listing shows an NSCAP page and a 2019 PDF of accredited companies. The NSA pages returned HTTP 403 to the fetch tool so nothing was read from the official site. A 2014 CISA reference aid mentions an earlier NSA 'cyber assistance' accreditation framework. Do not present as a current list.
Some details couldn't be verified. Confirm on the official page.
CREST incident response accreditation and Marketplace
CREST (not-for-profit, UK-registered)
CREST accredits companies for incident response after an expert-led assessment across six domains (per CREST's incident management page) and publishes accredited members on the CREST Marketplace, a searchable directory of about 551 companies with country, category and specialism filters. Some filters require a free account. CREST is an international body, not a US government program.
Some details couldn't be verified. Confirm on the official page.
NCSC Cyber Incident Response (CIR) scheme (UK)
UK National Cyber Security Centre
UK government scheme with a public 'find a provider' list of assured providers at Standard and Enhanced level. NCSC says all UK organisations should use an assured provider, and that it is not party to contracts. UK-only; relevant for readers with UK operations.
Some details couldn't be verified. Confirm on the official page.
Any US government list of qualified commercial IR providers
n/a
No current official US government program publishing a public list of qualified commercial incident response providers was verified. CISA does not appear to list providers (see cisa-cyber-incident-response-service); NSA NSCAP could not be read. State this plainly rather than implying one exists.
Some details couldn't be verified. Confirm on the official page.
How insurers handle approved vendors
If you have cyber insurance, your insurer may approve or require specific firms. See also our insurance directory. Cyber insurance directory.
Chubb: Cyber Incident Response Team partners
Chubb
Lists pre-approved forensics firms (separate US and Canada lists) on its partners page under 'Response, Forensics'. States the policyholder is under no obligation to contract with these providers, that the choice is the policyholder's independent choice, that Chubb does not endorse them, and that the policyholder should do its own due diligence.
Some details couldn't be verified. Confirm on the official page.
Beazley: report a cyber incident
Beazley
The claims page offers an online form and country contacts and describes Beazley Security, an in-house unit that helps insureds prepare for and respond to breaches. It does not mention an approved vendor panel, any must-use rule, or where a list lives.
Some details couldn't be verified. Confirm on the official page.
Travelers: file a cyber claim
Travelers
The cyber claim page says to file immediately after a known or suspected breach. It does not mention approved vendors. Navigation has a 'Find a Service Provider' link to /claims/claim-services, but that page lists only workers' compensation medical, auto medical, auto repair and emergency property providers, not cyber.
Some details couldn't be verified. Confirm on the official page.
Coalition: report a claim
Coalition
Page describes Coalition Incident Response as a premier on-call affiliate with digital forensics and incident expertise and says to refer to your contract for details. No outside panel or must-use rule is stated.
Some details couldn't be verified. Confirm on the official page.
At-Bay: claims
At-Bay
Page lists response partners (e.g. Arete, Kroll, At-Bay Response & Recovery) and says At-Bay Claims will reach out to determine which, if any, partners are needed. A footer link is titled 'Preferred Cyber Response Partners'. It does not say whether use is required.
Some details couldn't be verified. Confirm on the official page.
CNA: Cyber vendors
CNA
Names forensic experts, breach counsel and other vendors it has identified, and says CNA's Claims team will work with the policyholder to choose the vendors that best fit their needs. Page does not say whether use is mandatory or how other vendors are pre-approved.
Some details couldn't be verified. Confirm on the official page.
Credentials you may see
A credential describes training or testing by that body. It doesn't guarantee a firm's quality.
GIAC Certified Forensic Analyst (GCFA)
GIAC
Practitioner certification from GIAC (stated as ANAB-accredited to ISO/IEC 17024). Page describes coverage of advanced incident response and digital forensics, memory forensics, timeline analysis and threat hunting. Proctored hands-on CyberLive exam: 82 questions, 3 hours, 71% to pass.
Some details couldn't be verified. Confirm on the official page.
GIAC Certified Incident Handler (GCIH)
GIAC
Practitioner certification covering incident handling and computer crime investigation, attacker techniques and tools. Proctored CyberLive exam: 106 questions, 4 hours, 69% to pass for versions released on or after May 10, 2025.
GIAC Network Forensic Analyst (GNFA)
GIAC
Practitioner certification covering network forensic artifacts, protocols, NetFlow analysis, logging and wireless analysis. Proctored CyberLive exam: 66 questions, 3 hours, 70% to pass.
CISSP
ISC2
General information security certification from ISC2 covering 8 domains and requiring 5 years of work experience per the page. It is not specific to forensics or incident response.
Some details couldn't be verified. Confirm on the official page.
CREST individual incident response certifications
CREST
CREST's certifications page lists CREST Practitioner Intrusion Analyst (CPIA), Registered Intrusion Analyst (CRIA) and Certified Incident Manager (CCIM), with exams delivered at Pearson VUE. The page does not describe exam content or prerequisites.
Some details couldn't be verified. Confirm on the official page.
Other selection checklists
CREST Cyber Security Incident Response Supplier Selection Guide
CREST
A buyer's guide with questions grouped around a response framework (assignment, asset management, analysis, remediation, post-incident review). It frames four buying models: employ experts, buy a monitoring/response service, agree a response service in advance, or call someone when hit.
Some details couldn't be verified. Confirm on the official page.
Questions to ask before you sign
Retainer vs time-and-materials
- Do you offer a retainer, and what are your terms if we have none (hourly rates, minimums, start time)?PCI SSC Responding to a Cardholder Data Breach: some PFIs offer services on retainer
Availability
- How quickly can a named lead start, and is first-level phone response 24x7?PCI SSC: PFIs provide 24x7x365 first-level response and start within five business days of signing (card breaches)
Who is on the team
- Who exactly will work on our case, who leads it, and what are their qualifications?CREST Supplier Selection Guide, Assignment: skills, competence and qualifications of the team
Independence
- Do you or any affiliate have another relationship with us or our vendors that could create a conflict of interest?PCI SSC: PFIs must be independent; your QSA firm cannot be your PFI
Contract scope
- What does the contract say about responsibilities, authority to act on our behalf, and limits on what you may do?NIST SP 800-61r3 Section 2.2: responsibilities, information flows and authority to act should be defined in a contract
Evidence handling
- How do you collect, image, transfer, store and later return or destroy evidence, and do you keep chain-of-custody records?CREST Supplier Selection Guide, Asset Management: how assets/information are recorded, protected, returned or destroyed
Working through counsel
- Will you work under the direction of our outside counsel, and how do you structure the engagement letter and reports?CISA IRP Basics: attorneys often have preferences on engaging outside incident response vendors
Insurer approval
- Are you approved by our cyber insurer, and will you work within its billing and reporting rules? Do we need pre-approval to use you?Chubb: policyholder is under no obligation to use panel providers and should do its own due diligence
Data handling
- What access to our systems and data do you need, who at your firm will see it, where is it stored, and will you sign an NDA?NIST SP 800-61r3 Section 2.2: providers may have privileged access and sensitive data; NDAs and contracting clauses are options
Subcontractors and information sharing
- Do you use subcontractors or other customers' data/intelligence, and may you share anything about our incident with others?NIST SP 800-61r3 Section 2.2: restrictions on sharing sanitized incident information with other customers
Reporting
- What will you report, to whom and how often, and what will the final report contain?FTC guide: work with forensics experts and act on their reports
Credentials
- Which certifications or accreditations do your investigators and your company hold, and how can I verify them?General practice
Card breaches
- If payment cards are involved, are you on the current PCI SSC PFI list for the region where the breach occurred?PCI SSC PFI list: confirm status each time you engage a PFI
References
- Can you share references from similar-sized organizations and a sample (redacted) report?General practice
Fees and scope change
- What is excluded from your estimate (travel, tools, third-party licences, expert testimony) and how are changes approved?General practice
We have no affiliation or commercial relationship with any organization listed here. A listing is not an endorsement or a ranking. Contact details come from each organization's own website (checked 2026-11-03) and may change. We list a phone number or email only when we read it on an official page. Spot an error? Tell us. General information only, not legal advice: see the disclaimer.
More resources: all directories · Who to report to · Platform contacts · For affected individuals