Prepare before evidence is needed
Inventory AI services and their owners, define secure access and agree evidence-retention requirements. Identify which provider and internal teams must participate in an incident.
Specify mobilisation terms
- Who can activate the arrangement and through which channel
- Covered workloads, hours and locations
- Response expectations and reserved capacity, if contracted
- Fees, exclusions, third-party dependencies and authority
- Review cadence, exercises and termination arrangements
Test the handoff
Use a tabletop exercise to walk from detection through permission to act, evidence collection and recovery approval. A retainer proposal is not active coverage until its terms are accepted.
Define what the response commitment measures
| Milestone | Define in the agreement |
|---|---|
| Acknowledgement | A person confirms receipt through an agreed activation channel |
| Mobilisation | The named capability begins agreed scoping or investigation |
| Containment decision | Authorised owners assess and approve a proposed action |
| Containment verified | Evidence shows the targeted activity has been restricted |
| Recovery accepted | The service owner approves restoration against agreed criteria |
Commercial terms to compare
Clarify whether fees reserve capacity, buy readiness work, prepay incident hours or combine those elements. Specify overage approval, unused hours, expenses, third-party costs and termination. An acknowledgement target is not a guarantee that an unknown incident will be contained within that time. The cost guide and buyer checklist make proposal comparisons more precise.
Prepare the service before relying on it
Identify covered applications and dependencies, validate escalation contacts and ask administrators to demonstrate access to required record types. An AI incident tabletop can reveal whether the planned authority and records exist before a live event. Scope any resulting remediation separately.
