Incident Response and Preparedness

Managing the significant legal risk posed by possible or actual cybersecurity incidents in an interconnected world requires a sophisticated, proactive approach, and real-time guidance from the first sign of a possible incident. Our privacy and cybersecurity attorneys understand the threat that cybersecurity incidents pose to every organization. We have advised and assisted clients in responding to cyber incidents of every shape and size involving threats to sensitive data and critical systems, paying close attention to coordination between the various internal and external responders, helping clients avoid pitfalls that might otherwise increase litigation exposure, and minimizing the impact of such incidents on critical business operations. We also regularly apply that experience in advising clients on cybersecurity incident preparedness, helping them take proactive steps now that will lessen the impact of such incidents, and improve the client’s response, when a cyber incident does occur.

Incident Response

Our attorneys have overseen the response to potential and actual cyber incidents in diverse industries across the globe, including many of the largest incidents in history. Ropes & Gray’s global presence means that we can have a response team in place within 24 hours of discovery of a cybersecurity incident—anywhere in the world. Drawing upon our experience in managing and coordinating privileged investigations and responding to cybersecurity incidents, our attorneys advise on the myriad legal issues that arise during an incident and help an organization manage the crisis and avoid common and not-so-common pitfalls.  Our attorneys’ experience covers the entire range of cybersecurity incidents, including not only those that involve a theft or loss of data during the event (whether it be personal information, trade secrets, and/or confidential business or client information), but also ransomware, phishing, and denial of service attacks as well. We leverage our litigation and regulatory enforcement experience to recommend incident response strategies that are designed to reduce third-party claim exposure. For example, we closely monitor the types of post-incident statements that courts have relied upon in deciding whether or not to dismiss class actions at the motion to dismiss stage, and we use that knowledge to help clients draft public statements regarding their particular incident that are well calculated to reduce liability exposure.

Our particular areas of expertise include:

• Overseeing the forensic investigation of the scope of and reasons for the incident
• Advising on the implementation of appropriate containment, remediation, and security enhancement programs
• Advising on reporting and disclosure obligations under applicable laws
• Developing e-discovery strategies around preservation, collection, and Technology Assisted Review
• Providing other crisis management support, including guidance on internal communications and public statements, interactions with law enforcement, and interactions with the company’s Board of Directors and C-Suite executives

During any incident response scenario, our clients also receive the full benefit of Ropes & Gray’s dedicated E-Discovery practice. Our E-Discovery team has deep experience leading the immediate actions needed to meet the unique preservation requirements associated with the complex forensic data and database resources at the core of such situations, as well as the collection and review of same. Our E-discovery has designed the strategy, led, and managed the preservation, collection, and review of data many of the largest data incidents in history.  

Incident Preparedness

Our attorneys leverage their experience in managing complex cybersecurity incidents and their knowledge of relevant legal requirements and commercial best practices to assist clients in developing a robust incident response program designed to prep any organization and its employees in advance of the discovery of a cyber threat or incident. We regularly advise clients on designing protocols and practical ways to mobilize quickly the right people and resources, including:

• Designing a flexible incident response plan providing guidance on appropriate investigation, escalation, and communication protocols for cyber threats and incidents
• Identifying and engaging appropriate external resources to have in place in advance of a cybersecurity incident
• Conducting tabletop exercises with internal and external resources to practice cyber incident response
• Reviewing log generation and other data retention programs to ensure appropriate information is available for review by cyber incident response teams