An incident response retainer buys you outside forensic capacity when something goes wrong. An interim DFIR specialist gets your own organisation ready before it does. If you do not yet have an incident plan that has been tested, start with the specialist.
That is my advice to CISOs and security managers in the Netherlands who are working through the new Cyberbeveiligingswet, the Dutch law that implements the EU's NIS2 Directive. If your foundations are already in place, the order changes.
Retainer or interim DFIR specialist: what is the difference?
A retainer is a contract with an incident response provider. You pay up front for availability. When an incident hits, you ring a number and a team joins you to preserve logs, examine systems and work out how the attacker got in. That team does not know your environment. It works with whatever you can hand over on the night.
An interim DFIR specialist sits inside your organisation. They work with you for a few months, know the key systems and people within a week or so, and build what needs to be in place for a bad day: an incident response plan, playbooks for ransomware and account compromise, logs kept for long enough to investigate, and a reporting procedure people actually know. During an incident, they hold the overview and direct the outside provider.
What the Dutch NIS2 law expects in the first days
The Cyberbeveiligingswet has applied since 15 August 2026. Organisations in scope must take appropriate measures against risks to their network and information systems, and report significant incidents to their CSIRT and their supervisory authority within the legal deadlines. The board approves those measures, oversees how they are carried out and needs enough knowledge of its own to judge the risks.
The clock runs fast. The reporting factsheet from the NCSC, the Dutch National Cyber Security Centre, sets out an early warning as soon as possible and in any case within 24 hours, a notification within 72 hours and a final report within one month at the latest. If your organisation also falls under DORA or the Netcode, the Dutch technical code for grid operators, the early warning is due within four hours. Reports go through the mijn.ncsc.nl portal, which forwards them to both the CSIRT and the supervisor.
Do not count on the NCSC to fix the incident for you. Its factsheet on incident support says the centre focuses on identifying an incident. Containment and remediation are down to the organisation itself, possibly working with an incident response provider.
So within 24 hours you need to know what is happening, who reports it and what goes in the report. Someone has to have worked that out beforehand.
When an incident response retainer makes sense
A retainer works well once your own foundations are in place. You have an incident plan that was exercised in the past year, your SOC or MSSP knows when to escalate, and your logging is set up so an outside team can get going straight away. In that case a retainer buys exactly what you lack: forensic depth and people for the days when everything has to happen at once.
Read the contract carefully. What is the response time, and does it hold at night and at weekends? Will the team come on site, or is it remote only? What happens to unused hours at the end of the year? And has the provider worked with the systems that matter most to you, such as OT or a large Microsoft estate?
Agree in writing who on your side can call the provider in. If it needs sign-off from procurement or the executive team, you will lose hours on a Saturday night before anyone starts work.
When to bring in an interim DFIR specialist
An interim DFIR specialist is the right call when you cannot yet show that you would get an incident under control in the first 24 hours.
Over three to six months, expect an incident response plan that fits your organisation, covering roles, escalation and the reporting route to the CSIRT and supervisor. Alongside it come playbooks for the scenarios you are most likely to face and a review of logging and retention, so there is something to investigate when it counts. Get them to run a tabletop exercise with the board too, which helps directors meet their duty to understand the risks. Finally, they draft the tender for a retainer, setting out what you actually need.
At interview, ask about the last incident the candidate worked on personally. What did they do in the first hour, who did they call, and what would they do differently now? Someone with real DFIR experience will answer without hesitating. Our page on digital forensics and incident response sets out the profile in more detail.
Bear in mind that a DFIR specialist and a SOC analyst do different jobs. The analyst spots the alert and escalates it. The DFIR specialist investigates what happened next and keeps the evidence usable. If monitoring is what you mainly need, look at SOC operations instead.
My advice: prepare first, then sign the retainer
In my view, a retainer with no preparation behind it is an expensive phone number. The outside team arrives, asks for network diagrams, access and logs, and then waits while someone tracks them down. Those hours come straight out of the 24 you have for the early warning.
If you have no tested plan, hire an interim DFIR specialist first. Have them write the plan and playbooks, check the logging and draft the retainer tender. Sign the retainer afterwards, with a provider that fits what you have built.
If your foundations are already solid, reverse the order. The retainer comes first, and you bring in an interim specialist only to run an exercise or review the plan.
Pair the interim specialist with someone from your own team. Once they leave, somebody has to keep the plan current and run the exercises. For the wider picture on building NIS2 capability, see NIS2 compliance: the talent you need.
What to do now
- Check that you could send an early warning within 24 hours, or within four hours if DORA or the Netcode also applies. Who does that, and do they have access to mijn.ncsc.nl?
- Dig out your retainer contract if you have one. Do you know who can call the provider in, and how quickly they will turn up?
- Book a tabletop exercise with the board before the end of the year.
Looking for an interim DFIR specialist to get your incident response in shape? We place freelance and interim security specialists through MVPeople. Would you rather talk it through first? Give me a call or drop me an email.
