15.5 When to Get Professional or Legal Help
Escalation Is a Ladder, Not a Rope
Incidents do not respect org charts, so response needs a pre-agreed ladder: tier-one help desk for triage and "is this normal" calls; the internal security team and its declared incident commander when multiple systems or regulated data are involved; an external incident-response (IR) retainer when scope exceeds internal depth; and regulators, law enforcement, and outside counsel when duties attach to the organization itself. Trigger patterns that jump several rungs at once: ransomware with encryption in progress, business email compromise with payment diversion, suspected insider fraud by someone with admin access (their colleagues cannot investigate them), and any suspected breach of regulated personal, health, or payment data.
The IR Retainer Buys Time Before the Bad Night
A retainer is purchased before it is needed: it reserves response-hour capacity under an agreed SLA (often engagement within hours, not days), locks rate cards so nobody negotiates pricing in a firestorm, and pre-clears conflicts of interest. Many retainers are structured so the DFIR firm works at the direction of outside counsel, which in several jurisdictions brings forensic findings under attorney-client privilege or work-product protection -- the mechanism by which your own post-mortem does not automatically become the plaintiff's roadmap. Cyber-insurance policies typically hardcode a similar ladder: use of panel counsel and panel IR firms, with insurer notification inside a contractual window, or coverage can be contested.
Evidence Before Enthusiasm
The most expensive moments are the first hour. Wiping the "infected" laptop destroys the artifact that answers how they got in and what they took. The order matters: preserve before you act -- full-disk or VM-image acquisition, capture volatile state (running processes, network sessions, memory) before a reboot erases it, timestamp photos of dashboards and ransom notes, and write a chain-of-custody log naming who held what, when. Containment decisions such as isolating a segment versus keeping a machine online for live forensics belong to the IR playbook, not to whoever typed sudo first.
Regulators, Counsel, and Law Enforcement
External duties usually run through lawyers: the GDPR's 72-hour authority notification, state breach-notification letters, sector rules like HIPAA's breach portal, and extortion decisions (paying can itself be a sanctions violation in some jurisdictions, which is why payment is a counsel-plus-insurer decision, not an IT one). Law-enforcement routes such as the FBI's IC3 complaint portal exist for reporting and for intelligence, and some regimes make early reporting a mitigation factor. Rule of thumb: if the answer to "what do we tell people?" could include the words "notice," "regulator," or "subpoena," the call is legal, not technical.
Architecture Diagram
Key Takeaways
- Use a pre-agreed ladder: help desk, internal security, IR retainer, then counsel and regulators.
- Ransomware, BEC, privileged insider fraud, and regulated-data breach skip rungs -- escalate immediately.
- Retainers and cyber-insurance work because they are signed before the incident and route forensics through counsel.
- Preserve before you act: image disks, capture volatile state, log chain of custody, never wipe first.
- If the conversation reaches notice, regulator, subpoena, or ransom payment, the decision belongs to legal.