Breach Reports: How to Work Closely with Counsel

Reports generated by internal and external cybersecurity incident response teams are universally requested during the discovery phase of post-incident litigation. They serve as a roadmap for plaintiffs to understand the technical vulnerabilities that allowed the incident to occur. Accordingly, organizations are incentivized to assert and maintain the privilege of the reports to prevent production and limit legal liability. Even though they have compelling interests to share the report internally to harden systems after an incident, the courts have not interpreted privilege to allow both the protection from production and internal use for technical hardening. This session will discuss attorney-client privilege vs. work product privilege and confidentiality, as well as application during a data breach and litigation.