Court Decision Provides Guidance on Preserving Privilege in Cyber Incident Response
The U.S. Court of Appeals for the Sixth Circuit’s (Sixth Circuit) decision in In re FirstEnergy Corporation provides important guidance on how companies can preserve attorney–client privilege and the attorney work product doctrine during internal investigations – guidance that translates directly to cybersecurity incident response investigations. The Sixth Circuit confirmed that internal investigations led by outside counsel, where legal advice is rendered and such investigation is undertaken because of real or reasonably anticipated legal exposure, remain protected under attorney-client privilege and attorney work product doctrine, as applicable, even when the findings later inform business or operational decisions. For companies facing increasingly frequent and complex cyber incidents with subsequent class action lawsuits, the Sixth Circuit decision offers a clear message: engage outside counsel early, ensure such counsel leads any cybersecurity investiga...