Dear Mary,
I’m the general counsel of an organization and have recently started getting involved in the cybersecurity side of things. As I’m getting my bearings, I’ve noticed that our security team doesn’t always involve the legal department when an incident is suspected. While I understand that not every incident requires our involvement, I’m concerned that we’re being left out of matters that do need legal oversight, and when we are involved, it’s often too late. What can I do to help address this?
– Living in FOMO
August 14, 2024
Dearest L. FOMO,
Your concern is both valid and common among legal teams everywhere. But worry not, for there is a solution, and it begins with understanding your security team’s formalized triage process. Here’s what you need to know:
- Understand the Triage Process: Security teams typically use a triage process to determine how to escalate and respond to each detected incident. They might assign a severity level to incidents on a scale from 1 to 4 — Level 1 being routine incidents that internal IT can handle, and Level 4 being major incidents requiring a response. This triage process usually dictates which matters require legal involvement and which do not. For example, the triage process may dictate that only Level 3 and 4 incidents need to be escalated to Legal, meaning Legal will not be notified of Level 1 and 2 incidents.
- Define Legal’s Role: Your mission is to ensure that the triage process clearly dictates which incidents need to be escalated to Legal and when. As you correctly noted, not all cybersecurity incidents require the same response or lead to the same outcomes. Historically, however, security teams have struggled to identify which incidents will have legal implications, often skipping critical steps needed to mitigate potential legal exposure. Consequently, you should work closely with them to define the matters Legal should be involved in from the outset and ensure there is a protocol in place to provide such notification. This might include incidents that could potentially implicate sensitive or confidential data, affect many individuals, involve certain types of attacks (e.g., ransomware or other network intrusions), or are likely to result in consumer/customer harm or otherwise trigger regulatory scrutiny. Incident response is not always black and white, so if the security team is ever uncertain about whether an incident meets a certain classification level, encourage them to view Legal as a partner in this process and to reach out for discussion.
- Periodic Review: Once you have reviewed and are comfortable with the documented triage process, implement an internal audit system to ensure that security incidents are being classified correctly and that those requiring legal involvement are being escalated appropriately. While some misclassifications are inevitable, if you notice recurring errors, it may be necessary to revisit the triage process to determine what adjustments are needed or what additional training should be provided to address potential gaps.
By understanding, refining, and auditing the triage process, you can alleviate your fear of missing out on critical incidents or being involved too late. With that worry off your plate, the only thing left to ponder is … what does Legal do once notified?
Yours truly,
— Mary
“Dear Mary,” an advice column from Troutman Pepper’s Incidents + Investigations team, will answer questions about anything and everything cyber-related — incident response, forensic investigations, responding to regulators, breach-related litigation, and much more. “Dear Mary” goes beyond the articles, podcasts, webinars, and other content we produce, as we are responding directly to our reader’s questions with concise, practical answers. Answers will be general in nature and will not contain legal advice. If you need legal advice or representation, please contact one of our attorneys directly. “Dear Mary” also can be found here on the firm’s website.