The breach is live. When do you call outside counsel?

Earlier than you think, and for a reason most people get backwards.

Counsel isn't there to slow the response down. They're there so that the investigation you're about to run is done under privilege, which means the honest, ugly, half-formed findings of the first few days can be discussed without every draft becoming discoverable later. If you wait until you're sure it's serious, you've already generated a week of unprivileged email.

What counsel actually changes

Three things, in my experience of how these engagements are structured.

• Who the investigators work for. When outside counsel retains the forensic firm, the work product is more likely to be protected. When IT retains them, it usually isn't.
• What gets written down and how. "We found the attacker in the domain controller" and "evidence suggests unauthorised access to a server; scope under investigation" describe the same moment. One of them will be read aloud in a deposition.
• Who decides on notification. Regulators and contracts set clocks. Counsel knows which clocks are running. Your security team shouldn't be guessing.

The question I'd ask on day one

Do we have counsel on retainer who's done this before, and do they have a forensic firm they already work with? If the answer is no, you're going to spend the first forty-eight hours of a breach procuring services instead of containing anything. That's a fixable problem on a quiet Tuesday and an expensive one on a bad Friday.

What this doesn't mean

It doesn't mean lawyers run the technical response. Containment decisions belong to the people who understand the systems. The point is to make those decisions inside a structure that protects the organisation afterwards, not to add a signature step to every isolation.

If you don't know who you'd call, that's worth a conversation before you need to make it.

Explore: More on incident response · Work with me