Privilege Chain - Attorney-Client Privilege in Cyber IR

The privilege chain in cyber incident response is the deliberate structuring of forensic engagements, internal communications, and work product so that the resulting findings are protected by attorney-client privilege and the attorney work-product doctrine. A well-constructed privilege chain typically engages outside counsel first, who then engages the DFIR firm under a Kovel-style agreement, with all findings reported to counsel and shared with the client through counsel.

How the Privilege Chain Is Built

1. Outside counsel is engaged first under an engagement letter for legal advice in connection with the incident
2. DFIR firm is engaged by counsel, not by the client, under an agreement that explicitly states the engagement is to assist counsel in providing legal advice
3. Reports flow to counsel first, with counsel selecting what to share with the client (and how)
4. Internal communications about the incident are marked privileged and confidential and limited to a defined privilege circle
5. The same DFIR firm is not used for non-privileged ordinary business work on the incident

Why the Privilege Chain Matters

Forensic findings often expose root causes, control gaps, and decisions that may be unfavorable in subsequent litigation or regulatory enforcement. Without privilege, those findings can be subpoenaed and used in class action suits, regulatory enforcement, and shareholder derivative actions. A well-constructed privilege chain protects the candor required for honest investigation while still preserving disclosure to regulators and affected individuals.

Limits and Risks

The privilege chain is not absolute. Courts have rejected privilege claims when the DFIR engagement was a continuation of pre-existing business work (In re Capital One), when the report was widely distributed within the company beyond counsel's control, or when the work was performed primarily for business reasons rather than legal advice. Construct the chain at the start of the incident and maintain discipline throughout.