The NFIR Incident Response Retainer is a contractual cybersecurity service that provides organizations with guaranteed access to NFIR's Computer Emergency Response Team (CERT) within 3 hours of reporting an IT security incident. The service operates 24/7, 365 days a year, accessible via a dedicated emergency number. Prior to any incident, NFIR conducts biennial Incident & Forensics Readiness inventories to document the client organization's IT infrastructure, processes, stakeholders, and crisis team. This preparation enables faster triage and containment when an incident occurs. When activated, the CERT follows a structured methodology: - Triage: Identifying affected systems and data sources, setting priorities, and forensically preserving evidence. - Containment: Restoring affected systems and verifying security to resume normal operations. - Post-incident: Producing a forensic investigation report with recommendations, and supporting communication with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and other relevant parties. The CERT is staffed by certified incident responders and digital forensic investigators who follow SANS Incident Response procedures. NFIR holds an official CERT designation from Carnegie Mellon University and operates as a licensed Private Investigation Bureau (POB) under the Dutch Ministry of Justice and Security (POB number 1672). The service uses Velociraptor as its primary incident response and forensics tooling, which can be deployed preventively within client environments. NFIR brings all necessary digital forensic equipment on-site when required.