Lesson 3.48: Working with legal counsel and regulators during an investigation
A week into a major breach, the questions start arriving: the data protection authority, the national cyber authority, the financial regulator, each with its own deadline. External lawyers are running parts of the investigation. The security leader's job is to make sure every answer is on time, comes from the same current facts, and that work done for legal advice is handled the way counsel set up. In the lab you track regulator questions, find an overdue one and answers built on outdated or informal sources, see which documents were prepared at counsel's request, and write the plan.
19 min
You will learn to
- Track regulator questions and deadlines
- Find overdue questions
- Check answers against the current fact base
- Distinguish work prepared at counsel's request from business records
- Write a response plan with owners
Key terms
- Regulator questions log
- One list of every question received, owner, deadline, status and source of the answer.
- Legal privilege
- Protection that may keep some communications with lawyers confidential; scope differs by country.
- Business record
- A document created for normal operations, generally not protected.
- Fact base changelog
- History of fact changes, used to trace which answers need updating.
- Cooperation
- How openly and reliably an organisation works with authorities; often weighed in their decisions.
← The three lines model and independence · All lessons · Working with files and directories →