A breach coach is a lawyer who coordinates legal and regulatory response after a cyber incident or data breach. They help preserve privilege, manage notification obligations, and control what is shared with insurers, forensics teams and regulators. Organisations use one early to reduce disclosure risk and avoid statements that create legal or evidential problems.
What a breach coach actually does
A breach coach is not just a legal adviser brought in after the fact. They help shape the response from the first hours of an incident, deciding how the organisation should frame the event, who should be involved, and how to keep legal strategy aligned with technical containment.
The role is especially important because incident response creates parallel pressures: restore operations, satisfy legal duties, preserve evidence, and avoid unnecessary admissions. A breach coach helps coordinate those pressures so the response remains coherent rather than fragmented across legal, security, insurance and forensic workstreams.
Why the role matters in a cyber incident
The main value of a breach coach is control of the response perimeter. Early legal involvement can help preserve privilege over sensitive communications and legal work product, while also reducing the chance that informal emails, draft notices, or hurried statements create avoidable disclosure problems.
They also help organisations decide what must be told, to whom, and in what sequence. That matters because breach response often involves insurers, outside forensics, outside counsel, regulators, customers, and sometimes law enforcement, all of whom may need different information at different times.
Used well, the breach coach becomes a coordination point for the Cyber Insurance Guide issues that often arise during a claim, including panel requirements, ransom decision-making, and the need to align legal strategy with insurer expectations.
Legal privilege, disclosure control, and notification pressure
Breach coaching exists because breach response is not purely technical. Once an incident is suspected, organisations may generate sensitive material very quickly: forensic notes, root-cause hypotheses, remediation plans, privilege logs, regulator drafts, and internal chat records. Without control, those materials can become discoverable or inconsistent.
The lawyer’s job is to structure the response so that privileged advice stays privileged where possible, while still allowing the organisation to meet statutory, contractual, and policy-driven notification duties. This is why the breach coach often works closely with the incident response team and with insurer-approved vendors from the outset.
That coordination is also where external threat intelligence can inform the legal posture. Reporting on attacker behaviour, credential theft, and post-compromise activity, such as Anthropic’s first AI-orchestrated cyber espionage campaign report, helps explain why legal teams now treat incident facts, attribution claims, and disclosure timing with extra care.
How breach coaching fits into incident response
A breach coach does not replace security operations, forensics, or crisis communications. Instead, they connect those functions so the organisation can investigate without over-sharing, document without over-committing, and notify without creating contradictory records.
In practice, that means the coach helps define what facts are sufficiently confirmed, what language is safe for external use, and what information should remain tightly held until privilege, insurance, and regulatory considerations are clear. The role is most valuable when the incident is material, uncertain, or likely to trigger formal reporting obligations.
For organisations that want a broader security control lens, the same response discipline aligns with NIST SP 800-53 Rev 5 Security and Privacy Controls, especially around incident response, auditability, and controlled handling of sensitive information.
When organisations should involve a breach coach
The best time to involve a breach coach is before the organisation starts improvising legal and technical communications under pressure. That is especially true where the incident may affect regulated data, trigger insurance claims, involve multiple jurisdictions, or require outside forensic support.
A breach coach is most useful when leadership needs a single legal point of coordination, not another silo. The role helps prevent a common failure mode: different teams telling slightly different stories to insurers, regulators, customers, and investigators.
Where the breach also involves identity compromise, session theft, or access abuse, the incident narrative may overlap with controls described in the NIST Privacy Framework and related breach-handling practices, because the response must account for both evidence preservation and downstream disclosure obligations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while SOC 2 (AICPA) and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SOC 2 (AICPA) | CC7.2 — Communications to External Parties | Breach response requires controlled external disclosure and coordination. |
| Recommendation — Control external incident communications so legal, insurer, and regulator statements stay consistent. | ||
| NIST SP 800-53 Rev 5 | IR-4 — Incident Handling | Breach coaching supports coordinated incident handling and response orchestration. |
| AU-6 — Audit Review, Analysis, and Reporting | Privilege and evidential integrity depend on how response records are reviewed and shared. | |
| Recommendation — Structure incident handling to preserve evidence and keep response decisions controlled. Review incident records carefully before sharing them beyond the response team. | ||
| ISO/IEC 27001:2022 | A.5.24 — Information security incident management planning and preparation | Breach coaching supports prepared incident management and defined response roles. |
| A.5.28 — Collection of evidence | The role helps preserve admissible evidence while legal and forensic work proceeds. | |
| Recommendation — Define legal and response roles before an incident so communications stay coordinated. Preserve evidence early and keep handling consistent with legal hold requirements. | ||