Engagement management - legal, scoping, communications #
Engagement structure
- Retainer - pre-signed MSA + SOW with pre-committed hours; shortens time-to-start from days to hours. "Retainer burn-down" quarterly conversion to proactive services if unused.
- Non-retainer - emergency engagement; signed engagement letter (never work without one); scope & staffing within hours.
- Scoping call - within 30 minutes you need: what signaled compromise, when, affected systems/users/data types, business impact so far, who else is engaged (law enforcement, carrier, breach coach, outside counsel), what's in flight (containment attempts), what logs/EDR coverage, what's privileged.
Legal & privilege
- Attorney-client privilege for IR work typically achieved via a Kovel arrangement: outside counsel retains the IR firm as their agent to advise counsel on technical facts. The engagement letter and all deliverables flow through counsel.
- Work-product doctrine protects materials prepared in anticipation of litigation. Keep that framing in reports.
- Upjohn warnings to employee custodians - "I represent the company, not you" - before interviews.
- Litigation hold notices preserve evidence; counsel issues, you honor the preservation scope.
- Dual-track reports - some engagements produce a privileged factual-findings report (counsel audience) and a sanitized exec summary that can be shared under NDA with regulators / insurers.
Regulatory notification clocks
| Regulator | Timeline | Trigger |
|---|---|---|
| SEC Item 1.05 (8-K) | 4 business days from determination of materiality | Public companies; effective Dec 18, 2023 |
| NYDFS 500.17(a) | 72 hours | Financial services licensees in NY |
| GDPR Article 33 | 72 hours to supervisory authority | Personal data breach, EU subjects; data subject notification "without undue delay" |
| HIPAA Breach Notification | Individuals w/o unreasonable delay <60d; HHS annually (or 60d if 500+) | PHI |
| CIRCIA | 72hr for covered incidents, 24hr for ransomware payments | CISA; rule becomes enforceable 2026 (final rulemaking) |
| PCI DSS 12.10 | Immediate to acquirer/brands | Cardholder data; only a PCI Forensic Investigator (PFI) can lead investigation - know whether your firm is PFI-approved |
| State AG laws | Vary (CA, TX, NY, etc. have specific timelines) | PII of state residents |
| GLBA Safeguards Rule | 30 days to FTC for 500+ consumers | Financial institutions |
| DORA (EU) | 4h/24h/72h/1mo tiered | Financial entities in EU, effective Jan 2025 |
OFAC & ransomware payment
- Payment to a sanctioned actor is illegal regardless of victim intent. Check SDN list and OFAC's cyber-related SDN before any payment.
- Sanctioned ransomware families/groups have included Conti (certain IDs), LockBit (post-sanctions), SamSam operators, Trickbot operators, Evil Corp.
- OFAC's Oct 2020 and Sep 2021 advisories outline the regulatory framework.
- Chain of custody for crypto tracing - Chainalysis Reactor, TRM Labs.
- Negotiation firms you'll run into: Coveware, GroupSense, Kivu, Arete.
- Document reasonable due diligence (OFAC check, risk disclosure to client) even if payment doesn't happen.
Insurance & breach coach dynamic
- Cyber insurance carriers maintain panel firms - pre-approved vendors (IR, breach coach, forensics, PR, call center, credit monitoring). Confirm carrier approval before expending unlimited hours.
- Common breach coaches (outside counsel specializing in incident response): Mullen Coughlin, BakerHostetler, Lewis Brisbois, Kelley Drye, Alston & Bird, Wilson Elser.
- The breach coach quarterbacks the engagement; the IR firm reports to the coach.
Containment judgment
"Isolate vs observe" is one of the classic judgment calls in IR. The answer: it depends on business impact tempo and intel value. Ransomware pre-encryption: isolate immediately. Nation-state in a long-dwell data theft: observe briefly to establish scope (what else do they touch, what's staging, what are the egress patterns), then coordinated containment. Mass-impact IoT botnet: isolate crown jewels, observe periphery. Always align with the client's risk tolerance and legal.
Client communications
- Daily SITREPs - written, timestamped, concise. Status by workstream (host, network, identity, cloud, SaaS, intel, legal). Known/unknown. Next 24h. Risks.
- War-room cadence - morning standup, mid-day pulse, EoD readout. Expand/contract based on tempo.
- Audience discipline - exec summary for C-suite & board (one page), technical appendix for IT/security, legal/regulatory language reserved for counsel-controlled docs.
- Negative capability - tell the client what you don't know as crisply as what you do. Avoid false certainty; attackers come back when the client thinks it's over.
- Rules of Engagement (RoE) doc - scope of hosts/accounts/clouds, authorized actions (RTR scripting, memory capture, forced password resets, isolation), communication channels, escalation path, hold-points requiring approval.
Triage prioritization heuristic
- Crown jewels first - identify the top 3-5 systems/accounts whose loss is unrecoverable.
- Blast-radius sweep - identity (IdP, DC), privileged accounts, backups, EDR management console. Treat an EDR console compromise as game over for that estate.
- Patient-zero + lateral path reconstruction - you need the "how" to scope the "what."
- Containment timed to intel-collection goals.
- Eradication after you're confident scope is complete; otherwise you tip the attacker, they go deeper.
- Recovery (rebuild, restore, re-enable), then lessons learned.