This is from an article aimed at smaller law firms but the advice holds true even for the largest organisations. We have friends who offer exactly this kind of ‘before the breach’ service that costs far less than engaging specialists in your hour of need…:
Most organisations will need a specialist IR Consultancy to help resolve the situation. Prices can vary and it is worth getting upfront fixed costs along with experience, case studies and any accreditations. The consultancy may be happy to honour the pricing for 12 months if they are needed, or offer some kind of subscription service like insurance, should an incident happen.
If an IR Consultancy can be commissioned before the event, it usually makes the response quicker. They may have procedures that need to be followed if a breach happens and they may install technology to enable a swifter response to the incident.