Keeping Attorney-Client Privilege in Incident Response

Privilege (and its cousin, work-product protection) exists to let a company investigate honestly without handing opposing counsel a roadmap. But courts have been inconsistent about when a forensic report counts as privileged legal work versus ordinary business record-keeping. Some judges have found privilege applies because the investigation was directed by counsel in anticipation of litigation. Others have ruled the opposite way when the same forensic firm was already on retainer for routine IT work, or when the report reads like a technical deliverable rather than legal analysis.

That split matters because the deciding factor usually isn't the content of the report. It's the paper trail around how the engagement was set up. Judges look at who signed the contract, who directed the scope, who received the findings, and whether the work would have happened anyway regardless of litigation risk. Get those pieces wrong and the privilege claim collapses, no matter how carefully the investigators wrote their conclusions.

The single biggest mistake we see is IT or the CISO signing the forensic engagement letter directly. It feels efficient. It also almost guarantees the report gets treated as a business record rather than legal work product.

The fix is structural: outside counsel retains the forensic firm, not your internal team and not your managed services provider. Counsel signs the engagement letter, counsel directs the scope of work, and counsel is the one who receives the draft report first. Your cybersecurity team and your day-to-day IT provider still do the technical work of containment, log collection, and remediation — they just aren't the client of record for the forensic investigation itself.

This is also where a lot of Texas businesses get tripped up with their managed IT relationship. If your everyday IT vendor investigates its own environment and writes the incident report, that report almost never survives a privilege challenge. The vendor has an ordinary-course business reason to document what happened regardless of any lawsuit, which is exactly the argument plaintiffs' attorneys use to strip privilege. A separate, purpose-built forensic engagement — retained by counsel, scoped for litigation, and walled off from routine IT reporting — gives you a much stronger footing.

Keep the forensic engagement letter completely separate from any existing managed services or network support contract. Mixing them, even informally, gives opposing counsel an easy argument that the forensic work was just an extension of regular IT services. A standalone engagement letter, a standalone statement of work, and a standalone invoice line make the "retained for litigation" argument much easier to defend.

If you carry cyber insurance, loop your broker in early too — many policies have panel requirements for counsel and forensic vendors, and getting that wrong can create coverage friction on top of the privilege problem. This is one more reason to think through cyber insurance readiness before an incident, not during one.

Privilege can be waived just by sharing the report too broadly. Every person who gets a copy, every all-hands meeting where findings get summarized on a slide, every forwarded email — each one is a potential waiver argument. Distribution should go through counsel, on a need-to-know basis, and ideally marked privileged and confidential on every page.

Here's a detail that gets overlooked constantly: the forensic report and the remediation to-do list should be two different documents. The forensic report is legal work product, written for counsel, describing what happened. The remediation plan — patch this firewall, rotate these credentials, rebuild that server — is an operational document your IT team needs to actually execute against. If you staple them together, you've just handed a plaintiff's attorney a single document that's half privileged and half not, and courts don't always sort that out cleanly in your favor. Keep them separate from the start. Your managed IT services team can work off the remediation list without ever touching the privileged narrative.

The FTC's Data Breach Response Guide tells businesses to consult with legal counsel and identify a forensics team together as one of the first moves after a breach — not counsel first and forensics later, and not forensics first with counsel added on for show. That sequencing is the whole point. When counsel and the forensic team are engaged as a unit from the outset, the privilege argument is baked into the relationship rather than argued for after the fact.

NIST's Incident Response guidance (SP 800-61r3) covers the technical playbook well, but it's deliberately silent on privilege mechanics — that's a legal question, not a technical one, and it's exactly why counsel needs a seat at the table before the forensic contract is signed, not after.

You don't want to be figuring out privilege structure while your file servers are encrypted. A few things worth doing now:

• Name outside breach counsel in your written incident response plan, with contact information kept current — not just "legal" as a placeholder.
• Have a pre-negotiated retainer letter template sitting with that counsel so an engagement can be signed within hours, not days.
• Pre-qualify one or two forensic firms counsel already works with, so the "identify a forensics team" step from the FTC guide happens in minutes.
• Write communication rules into your incident response plan: who can discuss the incident, through what channel, and that findings route through counsel first.
• Keep a written information security program current, since regulators and plaintiffs' attorneys both ask for it, and it's easier to defend your posture when the document already exists.

If you want a broader view of what belongs in that plan, including who gets notified in the first hour, it's worth reviewing your incident response plan's notification list against current practice rather than guessing under pressure.

This kind of pre-incident structure is also exactly what a fractional security leader builds into a company's governance before anything goes wrong. If you don't have that role filled internally, fractional vCISO leadership is a reasonable way to get the IR plan, counsel relationships, and retainer templates in place without a full-time hire.

If your business falls under sector-specific rules — HIPAA, GLBA, or the FTC Safeguards Rule — your breach obligations and your privilege strategy need to work together, not against each other. Regulatory notification deadlines don't pause for privilege disputes, so counsel needs to manage both tracks simultaneously. Texas's SB 2610 also matters here: implementing the CIS Controls IG1 safeguards can shield a business with 20-99 employees from exemplary damages in a breach suit, per Texas SB 2610, though it doesn't create a private right of action and it only applies to exemplary damages — it's a mitigation layer, not a shield against the lawsuit itself.

Courts have gone both ways on forensic report privilege, even with every best practice followed. Some rulings turn on jurisdiction, some on the specific wording of the engagement letter, some on facts nobody could have predicted. Nothing in this post is legal advice, and it isn't a substitute for talking to a Texas-licensed attorney who handles data breach litigation before you need one. What it is, is a starting point for the conversation to have now, while you still have the luxury of time.

Does attorney-client privilege automatically cover a forensic investigation after a breach?

No. Privilege depends on how the engagement is structured — who retains the forensic firm, how the scope is written, and how the findings are distributed. Courts have ruled both ways on nearly identical fact patterns, which is why the setup matters so much.

Can our regular managed IT provider do the forensic investigation and still have it be privileged?

It's risky. If the same vendor already does routine IT work for you, opposing counsel can argue the report would have existed anyway for business reasons, which undercuts the privilege claim. A separate engagement, retained by counsel, with a distinct forensic firm, is a stronger position.

Should the remediation plan and the forensic report be combined into one document?

No — keep them separate. The forensic report is legal work product prepared for counsel. The remediation to-do list is an operational document for your IT team. Combining them muddies the privilege argument for the whole package.

Who should we notify first after discovering a breach?

Counsel should be on that list from the first hour, alongside your incident response team and forensic partner. Review your written incident response plan's notification sequence now so you're not improvising it during an active incident.

If your incident response plan doesn't name counsel, doesn't have a pre-negotiated retainer letter, or hasn't been tested against a real scenario, that's a gap worth closing before it costs you a privilege fight on top of a breach. Start with a free IT assessment or contact LayerLogix to talk through what your plan is missing.