Incident response and governance

Breach Response the Board and Regulators Can Defend

A breach puts the CISO, breach counsel and the board on the same clock with different questions. These guides explain how the technical record is preserved, what regulators expect it to show and how directors govern the risk before and after.

Get a free consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

The Decision Breach Counsel and the Board Face in the First Hours

When an intrusion is discovered, the IT team wants to restore service, breach counsel wants to know what was accessed, and the board wants to know whether disclosure is required and when. Each of those needs pulls on the same evidence. Rebuilding a server destroys the memory and the local logs that would have shown what the attacker did on it. Resetting an account without exporting its sign in record erases the proof of what the intruder reached. Waiting for a complete analysis before any decision is made is not an option when the New York SHIELD Act, the NYDFS cybersecurity regulation, the HIPAA breach rule and the SEC's four business day disclosure clock each start running on discovery rather than on understanding. The decision in the first hours is how to contain and recover in a way that keeps the record intact.

The guides in this topic treat that as a solvable engineering problem rather than a tension to be endured. Volatile memory and rolling telemetry can be captured in parallel with containment when the response plan assigns the task and the tools are ready. Notification scope can be narrowed to the individuals whose data the intruder actually touched when the audit record is complete enough to show which items were bound, synced or exported. A disclosure committee can judge materiality on facts rather than fear when the examination reports which systems and data were reached and which were not. In each case the same rule applies. Where logging was enabled and retained, the record speaks, and where it was not, the honest finding is that the record is silent and counsel should plan on that basis.

How to Read These Guides and in What Order

Start with the volatile evidence guide, which reconciles business continuity with preservation and lists the standards counsel will hold the response to. Then read the two New York guides, the SHIELD Act guide on using forensic telemetry to establish exactly what an intruder accessed and the NYDFS Part 500 guide on generating penetration testing and control evidence that supports the annual certification. The SEC disclosure guide follows, because the four business day clock after a materiality determination depends on the disclosure committee receiving hard technical facts quickly. Counsel working a live incident should read the first guide tonight and the other three as the regulatory questions arrive, since each one is written to be used in the order the obligations attach.

The second half moves from the incident to the governance around it. The pre close due diligence guide is for deal teams who need to know whether a target carries an undisclosed breach into the transaction. The AI red teaming guide explains what a reproducible finding must contain when an enterprise AI deployment is tested. The legacy publications that close the topic address the governance record a board must now be able to show, cyber insurance underwriting and claim recovery, executive and board member identity protection, and why an independent technical perspective benefits the CISO. Read in that order the topic moves from the hour of discovery to the quarterly board meeting where the response is judged.

What GDF Does for Breach Counsel, CISOs and Directors

Global Digital Forensics has operated since 1992 and answers its 24/7 hotline from sixteen US offices. In an incident the firm works under the direction of breach counsel so that the technical analysis supports the legal advice. We capture volatile memory and rolling logs in parallel with the client's containment, preserve tenant and identity records before retention windows close, scope the intrusion to specific hosts, accounts and data, and write a report that states what the record establishes about access and exfiltration and where it goes silent. That report is what breach counsel uses to decide notification scope under the SHIELD Act or HIPAA, what the disclosure committee uses to judge materiality, and what the insurer sees when the claim is made. Our examiners have testified in federal and state courts when an incident became litigation.

Before an incident the same examiners perform the work directors are now expected to oversee. Manual penetration testing, NYDFS cybersecurity evidence engagements, cyber due diligence for acquirers and AI security testing each produce a dated record a board can point to. Incident response retainers set the terms, contacts and preservation steps in advance so that hour zero is spent collecting evidence rather than negotiating an engagement letter, and forensic readiness planning verifies that the logs an examiner would need actually exist and are retained. The firm serves Fortune 1000 companies, AmLaw 100 firms and the regional enterprises that face the same obligations without a security operations center.

How to Begin

If the incident is live, call (800) 868-8189 now. Either the CISO or the general counsel can make the call, and the sooner it comes the more of the record survives. The examiner who answers will ask what has been observed, what has already been changed, which systems and accounts are suspected and whether counsel has been retained, and will give immediate preservation instructions before any engagement paperwork is discussed. The initial consultation is free. If the matter is not urgent, request a consultation online and we will schedule a call with counsel and the security lead together, because the response works best when both hear the same scope.

Two resources help before that call. The common digital evidence mistakes guide lists the containment steps that destroy the record, and the forensic readiness assessment page explains how an organization verifies in advance that it would be able to scope an intrusion. For boards and audit committees, the executive cyber risk advisory describes the documented cadence of assessment, reporting and tabletop exercise that lets directors show they oversaw the risk. Bring whatever incident timeline exists, even an informal one, since the examination is faster when it starts from the client's own account of what was seen and when.

Read in this order

The Guides in This Topic

Guide
Preserving Volatile Evidence in the First Hours of Incident Response Without Slowing Down Recovery
For CISOs and breach counsel in the first hours of an intrusion, settling how memory and rolling logs are captured in parallel with containment and recovery.
Guide
New York SHIELD Act Breach Response: How Counsel Reconciles Enterprise Data Records to Limit Notification Scope
For counsel deciding SHIELD Act notification scope, settling how audit telemetry establishes which records the intruder actually reached and which it did not.
Financial services control evidence
NYDFS 23 NYCRR Part 500 Compliance: Validating Shared Cybersecurity Controls Across Affiliates and Third Parties
For covered entities under NYDFS Part 500, settling what penetration testing and shared control evidence the annual certification needs across affiliates and third parties.
SEC disclosure evidence
SEC Cybersecurity Disclosure Rules and Materiality Determinations: Technical Evidence for Form 8 K and Board Oversight
For disclosure counsel and audit committees of public companies, settling what technical facts the four business day materiality clock requires and who supplies them.
Guide
Pre Close M&A Cyber Due Diligence: Uncovering Hidden Breach Liabilities That Change Deal Terms
For private equity and corporate deal teams, settling how compromise assessments and source code audits before close uncover breach liabilities that change terms.
Guide
Enterprise AI Red Teaming: Validating LLM Security, Prompt Injection Paths and Data Leakage With Reproducible Proof
For security and legal teams deploying enterprise AI, settling what a reproducible red team finding must contain to support a position before a regulator.
Cyber risk governance
Enterprise Cyber Risk Governance: Unifying Pre Incident Testing, Retainer Readiness and Breach Analysis Under Counsel
For boards and general counsel, settling the governance record directors must be able to show across testing, retainer readiness and breach analysis under counsel.
Cyber insurance
Cyber Insurance Underwriting and Claim Recovery: Proving Control Maturity Before Renewal and After a Breach
For risk managers and counsel facing renewal or a claim, settling how control maturity is documented before underwriting and defended after a breach.
Executive protection
Executive and C Suite Cyber Targeting: Why Board Members and Senior Officers Require Specialized Identity Protection
For boards and senior officers who are the entry point for intrusions, settling what executive device and administrator identity examinations establish about targeted intrusions.
Independent validation
Independent Cybersecurity Validation: Why CISOs and Audit Committees Need an Objective Technical Perspective
For CISOs and audit committees weighing independent validation, settling what an outside test establishes and what a clean report does not mean.

Frequently asked

Questions Readers Ask in This Topic

Should we restore systems before the forensic examination is complete?

Recovery does not have to wait, but it has to be sequenced. Capture memory and local logs from affected hosts, export identity and tenant records and preserve firewall and endpoint telemetry before systems are rebuilt or accounts reset. Those steps take hours rather than days when the response plan assigns them. Restoring first and preserving later leaves counsel without the record needed to scope notification, satisfy regulators or support an insurance claim.

What does the New York SHIELD Act require after a breach?

The SHIELD Act requires notice to affected New York residents when private information was accessed or acquired without authorization, and the Attorney General weighs whether the business can show which records were reached. A forensic examination narrows that scope by reading audit logs that record what the intruder's sessions bound, synced or exported. Counsel makes the notification decision. The examination supplies the record that decision rests on.

How quickly must a public company disclose a cyber incident to the SEC?

Under the SEC's cybersecurity disclosure rules a registrant must file a current report within four business days of determining that an incident is material, with a limited delay available only on a national security or public safety determination by the Attorney General. The materiality determination is made by management and counsel and must be made without unreasonable delay. The forensic record supplies the facts about which systems and data were affected.

Talk with an examiner

Bring the Question to an Examiner Who Has Testified

If your matter sits inside breach response the board and regulators can defend, call and describe it in plain words. A senior examiner will tell you which guide applies and what the first step is. The initial consultation is free.

Call (800) 868-8189 Get a free consultation

24/7 hotline: (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed October 31, 2026.