The general counsel is pulled into every serious cyber incident, yet the legal function often meets the security programme for the first time in the middle of a crisis, when the privilege structure, the notification clocks and the contract terms are already fixed. This guide sets out the general counsel's role across the full cyber risk lifecycle: before an incident, during response and in the months of regulatory and contractual follow-up. It covers ownership of legal decisions in the incident plan, how the main notification clocks interact, ransom and sanctions questions, contract terms that decide who bears the loss, and how to engage regulators. It is written for general counsel, deputy GCs, privacy counsel and the CISOs who work with them. The mechanics of privilege in forensic engagements are covered in the Legal Privilege in Incident Response Guide and are not repeated here.
Key takeaways
- Legal decisions need named owners before an incident. Materiality, notification, ransom, law enforcement contact and public statements are legal decisions; the incident plan should say who makes each one and on what evidence.
- Notification clocks start at different triggers. UK GDPR runs 72 hours from awareness, NIS2 runs 24 and 72 hours from awareness of a significant incident, and SEC Item 1.05 runs four business days from a materiality determination; one incident can start all three.
- Ransom questions are sanctions questions. OFAC treats sanctions violations on a strict liability basis, and early, complete reporting to law enforcement is a significant mitigating factor.
- Contracts allocate the loss long before the breach. Notice periods, cooperation duties, credential revocation, audit rights and liability caps in supplier and customer contracts decide who pays and who tells whom.
- Regulator engagement is a relationship, not a filing. Phased, accurate and consistent reporting builds credibility; contradictions between filings, customer letters and public statements destroy it.
What the general counsel owns in cyber risk
The general counsel rarely owns security controls, but owns the legal consequences of their failure. The useful split is between decisions the GC makes, decisions the GC shapes and decisions the GC only needs to know about.
| Area | GC role | Partners | Typical output |
|---|---|---|---|
| Incident privilege structure | Decides | CISO, outside counsel, insurer | Engagement letters, privilege protocol |
| Regulatory notifications | Decides | DPO, CISO, compliance | Notification decisions with documented rationale |
| Materiality and securities disclosure | Shapes, with the CFO | CFO, investor relations, CISO | Disclosure committee record, filings |
| Ransom and sanctions | Decides on legality, advises the board on whether to pay | CEO, board, insurer, law enforcement | Sanctions screening record, decision paper |
| Supplier and customer contracts | Decides standard terms and deviations | Procurement, CISO, sales | Security schedules, data processing terms |
| Litigation and evidence preservation | Decides | Forensics, IT, records management | Legal holds, chain of custody |
| Security policy and governance | Shapes | CISO, board committee | Policy approval, board reporting |
| Personal liability of executives | Advises | Board, CISO, D&O insurer | Indemnities, insurance review, decision records |
NIS2 Article 20 makes the point for in-scope entities: management bodies must approve the cybersecurity risk management measures, oversee their implementation and can be held liable for infringements, and their members must follow training. The general counsel is usually the person who explains that duty to the board. See the Board and Director Cyber Liability Guide and the CISO Personal Liability Guide.
Before an incident: building legal readiness
- Write legal decisions into the incident plan: for each decision (notify a regulator, notify individuals, disclose to markets, contact law enforcement, pay or refuse a ransom, issue a public statement) record the decision maker, the deputy, the evidence needed and the escalation trigger. See the Incident Response Plan Template.
- Pre-engage outside counsel and forensics: agree panel firms with the insurer, sign retainers with counsel directing forensic work where privilege is intended, and check the insurer's consent requirements. See the Incident Response Retainer Buyer's Guide.
- Map the notification regimes: one table per jurisdiction and sector, with the regulator, trigger, deadline and content. Keep it current: regimes change, and the UK ICO notes that PECR notification moved from 24 to 72 hours on 20 August 2025. See the Breach Notification Laws by Country Guide.
- Prepare templates: regulator notifications, customer letters, holding statements and an internal communications note that reminds staff not to speculate in writing. See the Regulator Notification Template Pack.
- Rehearse: at least one tabletop a year where legal decisions are forced under time pressure, including a materiality call and a ransom demand. See the Tabletop Exercise Guide.
During an incident: the notification clocks
The hardest legal work in the first week is running several clocks at once, each with its own trigger and content. Documenting when the organisation became aware, and why, is the foundation of every later filing.
| Regime | Trigger | Deadline | Notes |
|---|---|---|---|
| UK GDPR personal data breach (ICO) | Becoming aware of a notifiable breach | Without undue delay, not later than 72 hours | Reporting in phases is allowed; individuals told without undue delay where risk is high; all breaches recorded under Article 33(5) |
| NIS2 significant incident (CSIRT or competent authority) | Becoming aware of a significant incident | Early warning within 24 hours; notification within 72 hours; final report within one month of the notification | Applies through national transposition; check the member state law |
| SEC Form 8-K Item 1.05 | Determination that the incident is material | Generally four business days | Delay only where the US Attorney General finds a substantial risk to national security or public safety |
| US CIRCIA (CISA) | Reasonable belief that a covered incident occurred; ransom payment | 72 hours; 24 hours for ransom payments | Applies only once the final rule takes effect; CISA's page in November 2026 showed reporting as voluntary until then |
| Contractual notices | As defined in each contract | Often shorter than statutory deadlines | Customer and supplier contracts, insurer notification conditions |
The ICO warns that failing to notify a notifiable breach can lead to a fine of up to £8.7 million or 2% of global turnover. A decision not to report must be justified and documented. In the US, state breach laws add further deadlines. See the Data Breach Notification Checklist and the CIRCIA Incident Reporting Guide.
- One fact base: every filing, customer letter and public statement draws on a single, versioned statement of facts approved by legal. Differences between versions are deliberate and explained.
- Say what is known: phased reporting lets the organisation report early and update; speculation about scope or cause in an early filing is hard to retract.
- Evidence preservation: issue legal holds early, covering logs, chat channels and cloud audit trails, and check log retention before it expires. See the eDiscovery and Legal Hold Guide.
Ransom, sanctions and law enforcement
OFAC's updated advisory of 21 September 2021 states that civil penalties for sanctions violations can be imposed on a strict liability basis, and that companies facilitating payments, including financial institutions, cyber insurers and incident response firms, need sanctions compliance programmes that address ransomware. It treats a self-initiated, complete report to law enforcement as soon as possible after discovery, full cooperation and meaningful cybersecurity practices such as offline backups and incident response plans as significant mitigating factors.
- Legality first: before any payment discussion, screen the threat actor against sanctions lists with specialist advice, and record the result.
- Report early: the decision to contact law enforcement should be made in the first hours, not after negotiation has started. See the Engaging Law Enforcement During a Cyber Incident Guide.
- Know the local rules: some jurisdictions have introduced ransom payment reporting duties or restrictions for particular sectors. See the Ransomware Payment and Reporting Laws Comparison Guide.
- Record the decision: the board's reasoning, the alternatives considered and the advice received, whichever way the decision goes.
See the Ransomware Payments and Sanctions Guide for the full sanctions analysis.
Contracts: allocating cyber risk in advance
Most cyber loss arrives through a third party: a supplier breach, a compromised integration or a customer claim. The contract terms decide who learns first, who pays and who controls the response.
| Clause | Supplier contracts (you buy) | Customer contracts (you sell) |
|---|---|---|
| Breach notice period | Short enough to meet your own statutory clocks (hours, not days), with defined content | Achievable within your detection and triage capability |
| Cooperation and information | Access to forensic findings, logs and indicators relevant to your data | Defined scope, protecting privilege and other customers' data |
| Credential revocation | Supplier revokes and rotates API keys, tokens and accounts on request and at termination | Clear process for customers to rotate keys you issue |
| Security obligations | Specific controls in a schedule, not "industry standard" | Controls you actually operate, matched to your attestations |
| Audit and assurance | Right to receive reports (SOC 2, ISO 27001) and to audit for high-risk suppliers | Standard assurance pack instead of bespoke audits where possible |
| Liability and indemnity | Data breach carve-out or super-cap proportionate to the data held | Caps aligned with insurance limits |
| Subprocessors | Notice and objection rights | Maintained list and flow-down terms |
For personal data, GDPR Article 28 sets mandatory processor terms; for EU financial entities, DORA Article 30 sets ICT contract provisions. See the GDPR Article 28 Processor Guide, the DORA Article 30 Contract Provisions Guide and the Third-Party Security Contract Clauses Template.
Where identity fits
Machine credentials are a contract issue that legal teams often miss. Integrations with SaaS suppliers, payment providers and outsourcers run on API keys, OAuth grants and service accounts that outlive the people who created them. When a supplier is breached, the first containment step is usually to revoke and rotate those credentials, and the contract should give the organisation the right to require it and the information to do it. At termination, the exit clause should require confirmation that every credential the supplier held has been revoked. See Vendor contract clauses for credential revocation and breach notice.
Regulator engagement after the first filing
The first notification opens a relationship that may last months. How the organisation behaves in that period shapes the outcome as much as the original failure.
- Single point of contact: one named legal lead for each regulator, with the CISO or DPO available for technical questions in prepared sessions.
- Consistent account: the regulator will compare the notification with customer letters, press statements and, for listed companies, securities filings.
- Timely updates: follow up phased reports as committed, and correct errors promptly with an explanation.
- Remediation evidence: a dated plan with owners and proof of completion is persuasive; promises without evidence are not.
- Privilege awareness: decide in advance what reports will be shared and in what form. The privilege guide covers how sharing affects protection.
See the Regulator Investigation Response Guide and the Cyber and Privacy Regulator Directory.
Decision guidance: what changes by organisation
- Listed companies: the disclosure committee and materiality process are central; the GC works closely with the CFO. See the CFO Cyber Risk Guide and the SEC Cybersecurity Disclosure Rules Guide.
- Regulated critical sectors: NIS2, DORA or sector rules add short incident clocks and management accountability; national transposition details matter. See the NIS2 Directive Guide.
- Small legal teams: rely on a pre-agreed outside counsel retainer and a one-page decision matrix rather than building in-house depth for rare events.
- Multinationals: a lead jurisdiction approach for coordination, with local counsel for each regulator, and one central fact base.
- Privilege expectations: where litigation is likely, structure forensic work early; where it is not, the cost of a dual-track structure may not be justified.
Measuring legal readiness
- Decision ownership: percentage of legal incident decisions with a named owner and deputy in the plan (target 100%).
- Exercise performance: time from escalation to a documented notification decision in the last tabletop.
- Contract coverage: percentage of critical suppliers with a breach notice period shorter than your shortest statutory clock.
- Revocation rights: percentage of critical suppliers whose contracts require credential revocation on request and at exit.
- Regulator commitments: remediation actions promised to regulators completed on time.
Framework mapping
| GC area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal and regulatory requirements | GV.OC-03 | PM-9 Risk Management Strategy | A.5.31 Legal, statutory, regulatory and contractual requirements |
| Incident notification | RS.CO-02 | IR-6 Incident Reporting | A.5.5 Contact with authorities |
| Incident plan and roles | GV.RR-01 | IR-8 Incident Response Plan | A.5.24 Information security incident management planning and preparation |
| Supplier contracts | GV.SC-05 | SR-5 Acquisition Strategies, Tools, and Methods | A.5.20 Addressing information security within supplier agreements |
| Evidence preservation | RS.AN-07 | AU-11 Audit Record Retention | A.5.28 Collection of evidence |
Common failure patterns
- Legal joins late: forensic firms engaged by IT, early reports written without counsel, and the privilege structure decided after documents exist.
- Awareness undocumented: nobody recorded when the organisation became aware, so the regulator sets the start of the clock instead.
- Inconsistent stories: the regulator, customers and the market receive different accounts of scope and cause.
- Supplier notice too slow: a contract allows a supplier 30 days to report a breach, while your own regulator expects notification in 72 hours.
- Ransom discussed before sanctions screening: negotiation starts before anyone checks who is on the other side.
- Logs expire during the investigation: no legal hold reached cloud and SaaS audit logs with short default retention.
Practitioner checklist
- Name the owner and deputy for every legal decision in the incident plan.
- Maintain a notification regime table by jurisdiction and sector, reviewed at least twice a year.
- Pre-agree outside counsel and forensic retainers aligned with the insurer's panel.
- Prepare regulator, customer and holding statement templates and a single fact base format.
- Set supplier breach notice periods shorter than your shortest statutory deadline.
- Require credential revocation rights on request and at termination in supplier contracts.
- Include sanctions screening and law enforcement contact in the ransom decision process.
- Run an annual tabletop that forces notification, materiality and ransom decisions.
- Issue legal holds that reach cloud, SaaS and chat audit logs in the first day.
Standards and references
- ICO: Personal data breaches, a guide
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- US SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies
- CISA: Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
- US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
- UK Government: Cyber Governance Code of Practice
Related NHI Mgmt Group resources: Legal Privilege in Incident Response Guide · CISO Personal Liability Guide · Regulator Investigation Response Guide · Breach Notification Laws by Country Guide. This guide summarises legal and regulatory obligations relevant to general counsel and is not legal advice.