Dear Mary,

We had a security incident a few weeks backs that luckily turned out to be nothing. I’ll tell you, tension was high around here while the investigation was ongoing because there was a possibility that it was going to be bad. The forensic firm (hired by our outside counsel) figured out that the incident resulted from a misconfiguration in our MFA. We fixed that and now I’m wondering whether we really need a forensic report given the limited impact. I am not sure I understand the need.

– Uncertain in Atlanta

June 12, 2024

Dear Uncertain,

This is certainly one of those topics that gets people chatting. But if you ask me (which you did), I’d say seriously consider getting the forensic report, especially if it may be covered by attorney-client privilege. However, you need to remember two things: (i) even if you believe the report is privileged, assume that it will be part of litigation later; and (ii) the report needs to purely factual. The fact that there was a hiccup with the MFA configuration isn’t something that is privileged. So, documenting it in a forensic report doesn’t necessarily worsen your position (again, depends on how it is documented). You just need to make sure the forensic report is limited to the facts. There is no room for imagination, opinions, or speculations. Think nonfiction. Like this letter.

It’s also worth noting that the forensic report could come in handy later if any issues related to the incident pop up. It demonstrates the company was diligent in investigating the incident and took the right steps from an incident response perspective.

Glad to hear the incident turned out to be small. I guess the saying is true—MFA isn’t bulletproof.

— Mary

“Dear Mary,” an advice column from Troutman Pepper’s Incidents + Investigations team, will answer questions about anything and everything cyber-related — incident response, forensic investigations, responding to regulators, breach-related litigation, and much more. “Dear Mary” goes beyond the articles, podcasts, webinars, and other content we produce, as we are responding directly to our reader’s questions with concise, practical answers. Answers will be general in nature and will not contain legal advice. If you need legal advice or representation, please contact one of our attorneys directly. “Dear Mary” also can be found here on the firm’s website.