Standby agreement
$7,500 a year, credited in full against your first engagement. Conflicts cleared in advance, rates fixed and 15% off, a named contact, and a response commitment that exists only under signature. Including the case for not buying one.
- Document
- WW-F-011
- Version
- 1.0
- Issued
- 2026-09-11
- Last revised
- 2026-09-11
- Scope
- Annual standby terms and fee
- Authority
- Principal
$7,500 a year, credited in full against your first engagement
Signed while nothing is happening. You hold: a conflicts check run against a list you name, terms and rates fixed for the year, a named contact each side, a pre-signed out-of-hours authorisation with its own ceiling, and a written response commitment.
The retained rate is the published schedule at /rates less 15%, on hourly lines and fixed prices alike, with the out-of-hours and expedited uplift waived for the first 48 hours of an incident. Expenses and licences pass through at cost, undiscounted.
| Line | Published | Retained | What this does not establish |
|---|---|---|---|
| Principal — examination, analysis, opinion | $425/hr | $361.25/hr | A number of hours. |
| Forensic acquisition, per device up to 2 TB | $950 | $807.50 | Servers, RAID, NAS and virtual hosts — quoted after a call. |
| Emergency mobilisation block | $6,000 | $5,100 | The cost of the incident. indicative; confirmed at scoping |
| Annual standby fee | $7,500 | credited in full | A second discount; the credit applies once. |
Worked through. Month four: the mobilisation block at $5,100. The credit covers it and leaves $2,400 — under seven hours of examination: $2,400 ÷ $361.25 = 6.6 hr. After that, $361.25/hr against the written ceiling.
No surge rate, no overage rate
Hours past the credit bill at the retained rate, not above it. No overage multiplier, no premium band, no uplift because a matter is urgent.
Test any standby offer, mine included. Ask what an hour costs on the worst night of the year, and on an ordinary Tuesday. If they differ, the cheap fee is a deposit against a rate you have not been shown.
If nothing happens
The fee does not expire. At the annual review — a call, included — convert it into a tabletop exercise and plan review at $6,500, or a cloud logging and evidence-readiness review for one tenant at $4,200. both indicative; confirmed at scoping At the retained rate: $5,525 and $3,570; the difference carries forward.
Conflicts. Your list is confidential. If a name does not clear, I tell you that and nothing more. If one surfaces mid-matter, work stops, the evidence is sequestered unexamined, and the unearned balance is refunded in full.
Who should not buy one
| If this is you | What to do instead |
|---|---|
| Your cyber policy mandates panel vendors | Call your carrier first. Where the wording allows a non-panel examiner, tell me. |
| In-house DFIR, or a parent runs incidents for you | Buy nothing on standby. Instruct outside only for independence or testimony. |
| Worst case is one laptop, no regulator | Use the free call and the published rates. |
| Procurement can sign an engagement letter inside a day | Ask now for the terms, unsigned. That part is free. |
| The fee is a material fraction of a realistic incident | Do not buy it. Spend it on log retention, immutable backups, a tested restore. |
| What you want is the tabletop or the logging review | Buy that directly. Cheaper, same document. |
Under a standby agreement I will not
- Carry an overage or surge rate, whatever the hour.
- Bill above the ceiling you authorised in writing.
- Guarantee I can take the matter — only that I answer inside the interval and say so at once.
- Vary the rate with what I find or which side you are on.
- Renew quietly, hold a card on file, or deduct processing fees from a balance I am returning.
- Promise a finding, a recovered file, or that anything I produce will be admitted.
- Take a matter needing a certification or licence I do not hold. required certifications are named in the engagement letter, and met or the matter declined
The interval is not published — a printed figure promises everyone the same thing. Unsigned, there is none; see /emergency. Either party may terminate on notice; an unearned balance is refunded in full within ten business days, from the operating account — not trust, not escrow.
Ring me first
Ring 917-217-7975 and I will tell you in ten minutes whether this would earn itself for you. If not, that is what I will say. The call is free.