Insights · Field note · Security assurance and compliance
Working with legal, forensic and insurance partners during a breach
Four parties arrive in the first day with different priorities. Knowing what each needs, and in what order to call them, is part of readiness.
A significant breach brings in breach counsel, a forensic firm, the cyber insurer and often law enforcement, each with its own priorities: counsel protects the organization’s legal position and manages notification; forensics establishes what happened; the insurer controls coverage and often which vendors may be used; law enforcement wants evidence and may advise on the threat actor. The order usually matters: notify the insurer within the policy’s deadline, engage counsel so the investigation runs under privilege, bring in forensics through counsel using insurer-approved vendors, and coordinate law enforcement through counsel. All of these relationships should exist before the incident.
In detail
What the evidence shows.
The insurer first, within the deadline
Policies require notification within a defined period and often require use of approved counsel and forensic vendors for costs to be covered. Engaging the wrong firm before notifying can forfeit coverage. The policy terms, the deadline and the approved vendor list belong in the response plan, read before the incident.
Counsel and privilege
Breach counsel directs the investigation so that its findings can attract privilege, manages regulatory and contractual notification obligations and deadlines, and advises on communication. Engaging counsel in advance, with a retainer and a contact who answers at night, is cheaper than engaging them at the moment they are needed.
Forensics through counsel
The forensic firm establishes scope, timeline and cause from preserved evidence. Engaged through counsel and from the insurer’s list, its work supports both the legal position and the claim. The organization’s own evidence preservation determines how much the firm can establish.
Coordination
One incident lead, one log of decisions and communications, one channel to each partner. Executives briefed on a schedule from a template rather than ad hoc. See coordination with legal, forensic, insurance and technical partners, executive incident briefing templates and cyber insurance evidence.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days