Legal Privilege And Law Enforcement Cooperation In Cybersecurity Incidents

Establishing and maintaining legal privilege is a crucial part of cybersecurity incident response and risk management. Whenever an organization experiences a cybersecurity incident, its leaders need to protect the organization against legal and regulatory proceedings. They may be required to disclose information about both the attack and their response efforts. The question becomes, where does privilege fit into these disclosures?

The importance of identifying and protecting privileged information among such document sets is reflected in both industry practice and official guidelines. For instance, the Office of the Superintendent of Financial Institutions (OSFI) issued a guideline earlier this year for federally regulated financial institutions (FRFIs) regarding managing technology and cyber risks, wherein they recommended FRFIs take steps to establish legal privilege over communications and documents relating to cybersecurity compliance and incident response.