Aon | Professional Services Practice
Release Date: October 2022
Attorney-Client Privilege and Work Product Protection of Cyber Breach Investigation and Response Reports
By Jennifer Finnegan, Senior Vice President and Executive Director
In the wake of a cyberattack, firms often hire legal counsel and cybersecurity consultants to help remediate the breach, limit business interruption, comply with contractual and legal reporting obligations, and prepare for potential litigation or regulatory action arising from the breach. In an article from the Quality Assurance Review, Fall 2022, Professional Services Practice’s Loss Prevention team addresses the standards that courts apply and the facts and circumstances they consider in deciding whether data breach consultants’ reports and related communications are protected from disclosure in subsequent litigation by the attorney-client privilege or work product doctrine.