5.2: Regulators, Insurers, Lawyers
Regulators, Insurers, Lawyers
An incident of any size summons three professions to your door, each with its own clock and its own definition of “cooperative.” Knowing what each one wants — before you need to know — is the difference between running your incident and having it run by other people’s deadlines.
The clocks, in one place
| Who | Trigger | Clock | The catch |
|---|---|---|---|
| SEC (US public cos) | Incident determined material | 8-K Item 1.05 within 4 business days of the materiality call | The clock starts at your determination — but the determination must be made “without unreasonable delay.” Slow-walking it is itself a violation. |
| State attorneys general | Breach of residents’ personal info | Varies — some states 30–45 days, some “without unreasonable delay” | Fifty states, fifty statutes. Your counsel maintains the matrix; you just need to know it exists and that “we only have customers in three states” is rarely true. |
| GDPR (EU data subjects) | Personal-data breach, risk to individuals | 72 hours to the supervisory authority | 72 hours from awareness, not from full understanding. Partial notification with follow-up is expected and fine. |
| Sector regulators (HIPAA, banking, etc.) | Sector-specific | HIPAA: 60 days; others vary | If you’re regulated, these clocks were in your onboarding. Someone should confirm they’re written down. |
| Your cyber insurer | Suspected covered event | Contractual — often “as soon as practicable” | The quietest clock and the most commonly blown. See below. |
You don’t memorize this table. You verify, on a calm day, that someone — your counsel, your broker — owns each row, and you put the table in the template from lesson 5.6.
The insurer: call them before you spend
Cyber policies have two traps for first-time incident leaders. Late notice — insurers can reduce or deny claims when notification came weeks in, after you’d “handled it.” Suspicion of a covered event starts the clock, not confirmation. Consent to incur costs — most policies require insurer consent (often via their approved panel of IR firms and counsel) before costs count as covered. The IR firm you like, engaged in hour two on your own signature, may be entirely on your own dime — and switching firms mid-incident because you discovered this is misery. The fix costs nothing: know your policy’s panel now, and if you have an IR firm you’d insist on, get it endorsed onto the policy before there’s an incident.
Call order in hour one is therefore: counsel, then broker/insurer, then IR firm — with all three ideally reachable through numbers you already have printed.
Lawyers: what privilege actually buys
Engaging outside counsel early — and routing the forensic firm’s engagement through counsel — is standard practice, and the reason is attorney-client privilege and work-product protection: the ability to investigate candidly, in writing, without every draft finding becoming discoverable in the class action that follows any sizable breach.
Two honest caveats. First, privilege is a shield for candor, not a tool for hiding facts. The facts of the breach are never privileged — what happened, to whose data. Privilege protects the analysis and the drafts. Second, it isn’t automatic. In the litigation after Capital One’s 2019 breach, a court ordered the Mandiant forensic report handed to plaintiffs — the firm was on a pre-existing business retainer, and the report looked like business-as-usual work, not counsel-directed legal work. Structure matters: counsel engages the firm, scopes the work, receives the report. Your counsel knows this dance. Your job is to start it early enough that there’s something left to protect.
And the outer boundary of all of this has a name and a conviction. Lesson 3.4 covered Joe Sullivan: concealing the incident — the thing all three professions exist to prevent you from being tempted by — is the one move with personal criminal consequences. Every clock in the table above is survivable. Missing them badly is expensive. Hiding from them is the felony.
What this means at your size
If you’re at a 50-person company: you won’t have in-house counsel or a broker on speed dial, which makes the calm-day work more important, not less. One page — counsel’s number, broker’s number, policy number, panel firms, the notification table — kept where an incident can’t delete it. That page is most of this lesson, operationalized. Lesson 5.6 is that page.