The Ruling That Changed Cybersecurity Incident Response Privilege Strategy
In May 2020, the Eastern District of Virginia issued a ruling in a breach litigation case that overturned what had been standard practice in cybersecurity incident response: engaging outside counsel to retain the IR firm, with the expectation that the forensic report would be protected under attorney-client privilege or work product doctrine.
The court ruled that the forensic report must be disclosed to opposing counsel. The deciding issue: whether the IR work “would have been prepared in substantially similar form but for the prospect of litigation.” The court found that because the company had an existing MSA with the same IR firm predating the breach, the work would have been conducted in the ordinary course of business regardless of litigation — and therefore the work product doctrine didn’t protect it.
For companies that have long-standing IR retainers, this ruling created a significant change in how privilege strategy must be structured around incident response.
Why Existing IR Retainers Create Privilege Risk
The traditional approach to protecting IR forensic reports was straightforward: engage outside legal counsel, have counsel retain the IR firm under the engagement letter, and the work product flows through the attorney-client relationship. The Eastern District ruling disrupted this.
The court’s analysis focused on the pre-existing commercial relationship between the breached company and the IR vendor. Because the company had used this IR vendor before — under a commercial MSA with ongoing SOWs — the court determined the vendor relationship was a business relationship, not a litigation-preparation relationship. The fact that outside counsel later engaged the same vendor under a new contract didn’t change the underlying nature of the relationship.
The practical implication: if your organization has a retainer or prior commercial relationship with an IR firm, engaging that firm through outside counsel may not be sufficient to protect the forensic report. The work product protection argument is weaker when a prior business relationship exists.
What the Ruling Means for Your IR Program Structure
The clearest protective structure post-ruling, absent settled appellate guidance to the contrary, is:
Engage a separate IR firm through counsel for significant breaches. For incidents where litigation is likely — large-scale data theft, ransomware with regulatory notification requirements, breach of a regulated entity — engaging an IR firm that does not have a prior commercial relationship with the company, through outside counsel’s engagement letter, provides the strongest privilege argument.
Maintain your primary IR retainer for operational response, not for privileged investigation. A retainer with your primary IR vendor still provides value: they know your environment, can respond faster, and can handle containment and recovery. The forensic investigation — the work that produces the written report — can be handled by a separate firm retained through counsel when privilege protection is needed.
Document the litigation purpose explicitly. The work product doctrine requires that the material be prepared “because of” the prospect of litigation. Outside counsel’s engagement letter should explicitly state that the forensic investigation is being conducted in anticipation of litigation. This documentation doesn’t guarantee protection — courts look at the substance of the relationship, not just the framing — but it’s a necessary element of the privilege argument.
Cyber Insurance and Privilege
Cyber insurance adds complexity to the privilege picture. Most cyber insurers have preferred IR vendors that policyholders are required or incentivized to use. When the insurer’s panel IR vendor also has a prior commercial relationship with the insured, the same privilege risk applies.
CyberOne recommends reviewing your cyber insurance policy’s IR panel requirements before a breach occurs and discussing the privilege structure with your legal counsel and broker. Some policies allow policyholders to engage non-panel IR vendors in high-stakes situations, but this typically requires insurer approval and may affect reimbursement.
The Incident Response Tabletop Approach to Privilege Strategy
The best time to sort out privilege strategy is before a breach. CyberOne’s IR tabletop exercises explicitly incorporate privilege considerations into breach scenarios: at what point does outside counsel get engaged, who makes the decision to bring in a separate forensic firm, how does the insurance notification interact with the legal engagement structure, and who owns the final forensic report.
Organizations that haven’t thought through this sequence before an incident face competing pressures during the event: the IR team wants to move fast, outside counsel wants to structure the engagement for privilege, the insurer has its own requirements, and the PR team has a timeline. Sorting out the answers in a tabletop — where the consequences of getting it wrong are a finding in a report, not a court-ordered disclosure — is far preferable to improvising under incident pressure.
State of the Law in 2026
The Eastern District of Virginia ruling has been cited in subsequent cases, and the legal landscape for IR report privilege has become more complex and jurisdiction-dependent. Some jurisdictions have followed the Eastern District’s reasoning; others have taken different positions on the ordinary course of business analysis. Outside counsel with cybersecurity breach experience in your jurisdiction should be consulted for current guidance — the law is not settled uniformly, and the privilege analysis for any specific incident requires legal assessment of the specific facts, relationships, and jurisdiction.
CyberOne’s position remains: structure IR engagements proactively, maintain separate commercial and privileged IR relationships for different breach scenarios, and get privilege strategy in place as part of your IR planning rather than figuring it out under pressure during an active incident.