A cyber incident is no longer a question of if, but when.  The actions an organization takes in the immediate aftermath can affect not only how quickly business operations return to normal but also the organization’s ability to maximize its recovery under its insurance program.  From a policyholder’s perspective, the following ten steps are essential.

1. Activate your Incident Response Plan:  Follow your written incident response plan.  Your plan should already have specific individuals assigned to specific tasks as part of the “incident response team.”  When you activate your plan, confirm the roles of each individual.  It is important to have a designated lead to coordinate across management, IT, legal, finance, and other departments.  A single lead ensures that the organization’s response is consistent and coordinated.  If no formal plan exists, you have a gap in your incident response preparedness that should be addressed immediately.
2. Notify your Insurance Broker and Provide Notice Under All Potentially Applicable Insurance Policies:  Instruct your insurance broker to provide notice of the incident under all potentially applicable insurance policies.  Do not limit notice to your cyber insurance policy.  First-party property, crime/fidelity, general liability, D&O, and E&O policies may all respond to some aspect of a cyber-related loss.  Provide notice promptly to avoid any potential late-notice defenses and to preserve all available rights under the applicable policies.
3. Use Panel Vendors or Pre-Approved Vendors for Incident Response:  Cyber policies typically require use of panel cyber consultants, forensic firms, breach coaches/ransomware negotiators, and PR consultants.  Those same policies usually allow for use of off-panel vendors if the policyholder first obtains written approval from the insurance company.  Ideally, your incident response plan includes pre-vetted panel vendors (or pre-approved off-panel vendors) “on standby” who can be activated along with your internal incident response team.
4. Engage Privileged Breach Counsel: Retaining experienced (and, where required, panel-approved) breach counsel at the outset allows the forensic investigation to be directed by counsel, helping maximize available attorney-client privilege and work-product protections over sensitive findings, subject to applicable law.  Your breach counsel or “cyber coach” will assist in directing negotiations with ransomware groups, communications to law enforcement, discussions with your cyber forensic investigators, and communications with your insurance company representatives and claims handlers.  Additionally, your breach coach will assist your organization in determining necessary notifications to affected individuals/parties, contractual counterparties, and local and state authorities and enforcement agencies.
5. Notify Law Enforcement:  Work with your breach coach to notify appropriate law enforcement authorities.  Typically, cyber crimes, including wire transfer fraud and ransomware attacks, should be reported to the FBI, which not only tracks cyber threats and incidents, but in the case of stolen funds, may, in some circumstances, be able to assist in freezing or recovering misdirected funds, particularly when notified quickly after the incident.Reports to the FBI are made through the Internet Crime Complaint Center (IC3) at https://complaint.ic3.gov.  Additionally, your breach coach can advise you on whether you should report your cyber incident to other agencies, like the Cybersecurity and Infrastructure Security Agency (CISA), and local authorities.
6. Preserve Evidence, Contain the Incident, and Avoid Premature Remediation:  In the immediate hours after discovery of the incident, and presumably before your cyber consultants have arrived, your internal IT team should isolate affected systems from the network, but they should not power down or reimage those systems.  Forensic consultants need intact drives and memory to properly investigate the incident.  Avoid allowing internal IT personnel to alter, restore, or reimage affected systems until forensic investigators have collected the information necessary to complete their analysis.  Law enforcement occasionally requests images or, in rare cases, physical equipment; any such requests should be coordinated through breach counsel to preserve documentation and coverage.
7. Comply with Notification Obligations:  Working with your breach coach, identify the applicable regulatory clocks (i.e., state attorney general breach-notification statutes, the SEC’s disclosure requirement for “material” cybersecurity incidents, HIPAA, GDPR’s 72-hour window), and provide timely notice under each applicable regulation.  Meeting one deadline doesn't satisfy the others.Beyond regulatory deadlines, review agreements with vendors, customers, and other contractual counterparties for breach-notification clauses.  Many commercial agreements (especially those involving shared data, SaaS platforms, or payment processing) impose their own notice windows, sometimes shorter and stricter than statutory ones.  Master service agreements, data processing agreements, and indemnification provisions can all trigger separate obligations owed to contractual counterparties, independent of notification obligations to regulators.Separately, and often on a distinct timeline, assess your obligation under state breach notification laws to provide direct notification to customers or clients whose personally identifiable information (“PII”) may have been accessed or compromised.  Again, your breach coach will assist with this assessment and in ensuring timely compliance.Missing any of these regulatory, contractual, or consumer-facing deadlines may expose the company to breach of contract claims, regulatory penalties, or loss of indemnification rights.  Your company’s breach response counsel should map all of these clocks together from the outset, not sequentially.
8. Control Communications:  Route all external messaging through designated leaders.  Avoid premature public statements or admissions that could create regulatory, evidentiary, or insurance coverage problems.Run all internal communications through breach response counsel to preserve attorney-client privilege and work-product protection.  Establish a company-wide communications protocol directing employees not to discuss the incident on public or unofficial channels, and not to speculate about the cause, fault, or liability for the cyber incident in writing.In prior high-profile cyber incidents, internal employee communications regarding the adequacy of cybersecurity controls have been cited by plaintiffs and regulators in support of liability allegations against affected organizations.
9. Document Your Losses and Recovery Costs; Keep Your Claims Adjuster Informed:  Keep contemporaneous records of every cost, decision, and vendor invoice, and prepare and submit a timely, well-supported proof of loss.Before retaining significant vendors, entering settlements, paying extortion demands, or incurring other substantial expenses, confirm whether insurance company consent is required under the applicable policies.  Policies often impose obligations, including a duty to cooperate, which may require a policyholder to provide information and updates to its insurance company.  Policies also frequently require a policyholder to obtain the insurance company’s consent before incurring certain expenses, engaging particular vendors, paying ransoms, settling claims, or admitting liability.Keep your claims adjuster informed throughout the investigation and recovery process.  Providing regular updates to your insurance company not only helps satisfy your duty to cooperate but may also reduce the likelihood of coverage disputes later in the claim process.
10. Assess Business-Interruption Exposure Early. Identify the policy’s temporal limitations on business interruption coverage.  At the “front end,” there is the policy’s waiting period, which requires a certain number of hours to pass before business interruption coverage attaches.  The “back end” is the “period of restoration,” typically defined in cyber policies as either the time it takes or reasonably should take to restore computer systems or to restore business operations to their pre-breach condition.  Avoid making any definitive statements regarding when systems or operations were restored.  Such statements may be used by the insurance company to prematurely end the period of restoration.  Often, however, those statements later prove incorrect once hidden issues with the computer system or business operations surface.If your organization suffers a business interruption loss as a result of a cyber incident, a forensic accountant can assist in identifying covered business-interruption losses, extra expenses, and supporting documentation needed to substantiate the claim under the policy's loss-calculation provisions.

How an organization responds in the first hours and days of a cyber incident often determines not just how quickly it recovers operationally, but how fully it recovers financially.  If you encounter resistance from your insurance company, engage coverage counsel to evaluate coverage under your insurance policies and assist with the recovery of your claim.  Preparation, coordination, and early counsel involvement are more than best practices; they are often the difference between a policy that exists on paper and one that responds when needed most.