IR: Optimizing Communications and Action Between Legal and Tech Leaders
summary
Panel outlines concrete incident-response rules: privilege requires attorney-client communications and legal purpose, so outside counsel retains forensic firm and limits report distribution to preserve privilege; create separate unprivileged executive summaries for mandatory reporting; avoid putting no remediation steps in report—remediation belongs to post-incident lessons and can create liability; keep MSAs and rapid SOWs ready so vendors start work within hours; use specialized ransomware negotiators, run tabletop exercises, document who does what, and follow a tested incident-response checklist.
AI-written summary · about
chapters (13)
- 0:00Introduction and panel setup
- 3:14Role of counsel in incidents
- 6:51In-house vs external counsel debate
- 13:13Forensic firm retention and privilege
- 18:16Privilege protection best practices
- 23:48Admissibility and remediation steps
- 26:15Mandatory reporting and privilege
- 29:03Cyber insurance and vendor panels
- 33:57Third-party breach attestations
- 38:35Insurance carrier involvement impact
- 39:17Ransomware payment and negotiation
- 44:16Incident response planning importance
- 45:21Key takeaways and closing advice
related talks
01h 00mWhat Was I Thinking?: Bungled Breach Responses
40mIncident Response – How to Give the Advantage to the Hackers!
41mHow to Keep Your Cool and Write Powerful Incident Response Reports
50mCyber Invisibility: Developing a Security Incident Notification Regime
23mEnforcing Your Code of Conduct: Effective Incident Response
44mPanel: Peak Performance Under Pressure: Building Cross-Functional Resilience in Incident Response
40mMulti-Front War: Mitigating Cyber Risk and Maximizing Security
36mFrom Dork to Diplomat: Communicating Coherently for Vulnerability & Incident Response