It’s go time. This is not a drill. The data is exfiltrated. The ransom note has been left on the server. The security team is working to contain the threat. The tabletop exercises prepared you for some of this. They didn’t prepare you for the flurry of communications, stress, and adrenaline.
In the heat of incident response, every message matters. Not just for operational success, but as potential evidence in future litigation and regulatory proceedings. Organizations face a delicate balance: respond quickly and transparently while protecting themselves from lawsuits and compliance violations. The instinct is to have attorneys direct everything, hoping to shield communications behind legal privilege. But courts increasingly reject these protections, and many critical incident communications fall outside legal boundaries anyway.
Understanding these limitations isn’t just about legal theory, it’s about building incident response processes that work under pressure while standing up to scrutiny later.
This blog explores how legal protections like attorney-client privilege and work-product doctrine apply to incident communications, why many crisis messages fall outside those protections, and what organizations can do to safeguard communications during a cyber incident.
Attorney-client privilege maintains confidentiality for all communications made between an attorney and their client. While this might seem like a blanket protection across all discussions with a lawyer, courts significantly limit this by applying it only to disclosures necessary to obtain legal advice. It does not extend to the sharing of underlying facts, for example, ultimately protecting only a small subset of communications that organizations share with their lawyers.
Work-product protection expands the scope of protected communications beyond privilege. However, courts limit this by focusing on the phrase “in anticipation of litigation or for trial.” As the DOJ Journal of Federal Law and Practice noted in May 2021, this protection only applies to the conversations and reports created after an incident rather than as part of normal business practice, meaning simply adding outside or in-house counsel to emails and communications may not trigger protection.
Crisis communications include internal discussions about an incident and external messaging provided to the media, government agencies, and people with compromised data.
Even if a court is willing to extend protections across forensic information created with an attorney-directed security firm, plaintiff’s counsel or regulators may request the organization’s internal and external crisis communications as evidence during litigation or a post-incident audit.
Increasingly, data protection regulations mandate specific timelines and requirements around crisis communications, like:
During incidents, organizations typically coordinate messaging across multiple internal teams. These communications may include:
These discussions primarily focus on operational response and communications with external stakeholders rather than litigation preparation. While organizations may consider how these communications could create legal liability, these conversations often fall outside attorney-client privilege or work-product protections.
Senior leadership needs to ensure that the Board of Directors understands the data breach's potential financial, compliance, and reputational impacts. While board communication may not occur during the initial investigation phase, directors typically request additional information and may call special meetings as the incident's scope and impact become clearer.
In a data breach’s aftermath, organizations often face civil lawsuits or regulatory investigations that can include discovery of all internal communications. While most organizations respond to incidents appropriately, their internal communications should demonstrate this fact. Simultaneously, organizations should secure these communications the same way they protect other incident data, such as event logs.
As organizations work to balance securing internal communications with preparing for litigation or audits, consumer secure communications applications, like Signal or WhatsApp, often fall short of providing necessary protections:
An organization’s incident response plan must consider the different risks arising from data breaches. Normally, organizations focus on detections, investigations, and recovery processes. In today’s litigious world, organizations also need to consider which communications should receive attorney-client or work-product protection and which communications they may need to provide during discovery.
Communicating across various teams is a fundamental challenge all organizations face during security incidents. Even more challenging, traditional internal communications channels may be insecure or unavailable after threat actors compromise systems. Organizations should adopt a solution that maintains secure communications despite system compromise and allows them to safely share information.
Maintaining the principle of least privilege is critical to ensuring attorney-client and work-product protections. Organizations often engage third-party providers to help with the investigation, making role-based access controls essential. Communication channels should provide team members only the information necessary for their specific functions:
Organizations should establish and implement well-defined communication processes, much like they do with incident playbooks. These communications plans should:
Organizations should practice incident communications with the same rigor applied to technical response processes. Tabletop exercises should include communications training to help teams understand:
Modern incident response requires purpose-built solutions that understand the balance between operational effectiveness and legal protection. Platforms like CYGNVS provide the audit trails, role-based access controls, and secure collaboration capabilities that organizations need to maintain defensible communication records while focusing on what matters most: containing the incident and resuming business operations.
Ready to strengthen your incident communications? Speak with an expert.