Protection depends on whether the investigation was conducted at counsel's direction in anticipation of litigation rather than for ordinary business or regulatory purposes. Dual-purpose investigations frequently lose protection.
Structure at engagement determines the outcome.
Alternative Names:
Cyber Incident Privilege|Breach Response Privilege
Why it Matters?
Engagement structure before the investigation begins determines protection, since courts examine who retained the forensic firm, who received the report, how it was used, and whether a substantially similar investigation would have occurred regardless. Retaining the forensic firm through counsel under a separate engagement, distinct from any pre-existing vendor relationship, is the practice that has survived challenge. Distribution beyond counsel undermines the assertion.
Frequently Confused with
Related terms
Frequently asked questions
What determines protection?
What practice has survived challenge?
