Statement of Work
Incident Response Retainer & Tabletop-Exercise-as-a-Service
Prepared by Starks Enterprise — starksenterprise.com · Irving "Gene" Starks Jr. · [email protected] · (980) 355-9706
Purpose & Overview
Starks Enterprise will provide Client with a recurring incident response retainer, a lightweight IR runbook, and scheduled tabletop exercises to validate and improve Client's readiness to respond to a security incident.
Scope of Work
Initial IR readiness assessment and runbook development/update
Definition of severity tiers, escalation paths, and communication plan
Quarterly (or agreed cadence) tabletop exercises with scenario design and after-action reporting
On-call IR retainer for active incidents during the term
Annual runbook review and update
Deliverables
IR runbook document
Escalation and communication plan
Tabletop exercise schedule with after-action reports per session
Retainer coverage confirmation and SLA document
Timeline
| Phase | Activities | Duration |
|---|---|---|
| Phase 1 | Readiness assessment & runbook development | 2-3 weeks |
| Phase 2 | First tabletop exercise & after-action report | 1 week |
| Ongoing | Recurring tabletop exercises & on-call retainer | Per agreed cadence |
Pricing & Payment Terms
| Item | Timing | Fee |
|---|---|---|
| Runbook development & initial assessment (one-time) | Due at kickoff | $5,000 - $9,000 |
| IR retainer + quarterly tabletop exercises (monthly) | Monthly, in advance | $1,500 - $4,000/mo |
| Active incident response hours (beyond retainer allotment) | Billed monthly in arrears | $287.50/hr |
Invoices are due net 15. Retainer fee is due whether or not an incident occurs during the period; it reserves response priority and covers included tabletop exercises.
Client Responsibilities & Assumptions
Client will provide timely access to relevant systems, personnel, and documentation needed for discovery.
Client will designate a single point of contact for the duration of the engagement.
Cloud infrastructure costs (hosting, compute, storage) are billed separately to Client unless otherwise stated.
All work is performed remotely unless on-site work is explicitly scoped and priced separately.
Pricing assumes a single production environment and a single tenant/client instance unless stated otherwise.
Retainer includes a defined monthly hour allotment; hours beyond that allotment are billed at the hourly rate above.
Out of Scope
Forensic evidence collection requiring specialized third-party tooling not already licensed to Starks Enterprise
Legal or regulatory breach-notification counsel (Client should engage outside counsel)
Remediation implementation beyond incident containment guidance, unless separately scoped
Acceptance Criteria
IR runbook reviewed and approved by Client stakeholders
First tabletop exercise completed with after-action report delivered
Retainer terms and escalation contacts confirmed by both parties
Term & Termination
This SOW renews automatically each term unless either party provides 30 days' written notice of non-renewal. Retainer fees are non-refundable once a term period has begun, regardless of incident volume. This SOW is governed by, and incorporated into, the Master Services Agreement between Starks Enterprise and Client.