For counsel, insurers and brokers

When a client's lawyer retains us, we work for counsel on the client's behalf. Counsel sets the questions, receives our findings, and decides what is written down, when, and for whom. We do not send findings directly to the client, insurer or anyone else without counsel's instruction.

Whether privilege attaches to our work is a legal question for counsel, and it depends on the facts of each engagement. Our part is to make the structure easy to maintain: a separate engagement letter with counsel, communications routed through counsel, draft reports marked as counsel instructs, and technical working notes kept apart from the client's operational IT records.

If the client also needs remediation work, we can scope that separately so the operational work and the investigation are not mixed in one file.

Each insurer and policy is different, but forensic questions on a cyber claim tend to fall into the same groups. We write reports so each can be answered with evidence or clearly marked as not determinable.

• Root cause: how the threat actor got in, and when
• Dwell time and timeline of attacker activity
• Systems, accounts and data affected
• Whether personal or confidential information was accessed or exfiltrated, and the basis for that conclusion
• Containment and eradication steps taken, with dates
• Whether the controls stated in the insurance application were in place at the time
• Time and cost records for the forensic work itself

Early decisions such as notification, business interruption estimates and whether to engage further vendors cannot wait for a final report. We therefore distinguish two kinds of output, and label them clearly.

Underwriting questionnaires now ask detailed questions about MFA, backups, endpoint protection and privileged access, and an inaccurate answer can cause trouble at claim time. Brokers can help clients by getting the facts checked before the application is signed.

For clients on Microsoft 365, our Microsoft 365 security assessment reviews the settings that questionnaires ask about, such as MFA, admin accounts, mailbox protection and audit logging. Clients receive their own findings; we do not share them with the insurer unless the client asks us to.

Evidence handling follows the approach described in ISO/IEC 27037 (identification, collection, acquisition and preservation of digital evidence) and NIST guidance for forensics in incident response:

• Every item collected is recorded on a chain-of-custody log: what, from where, when, by whom
• Forensic images and exports are hash-verified at collection and again before analysis
• Evidence is stored encrypted, with access limited to the people working the matter
• Retention and return or destruction of evidence follow the engagement letter
• Where the matter may lead to litigation, our methodology is written up so it can be explained to a court, in line with the Sedona Canada Principles' emphasis on reasonable, good-faith preservation

For an active incident (ransomware, business email compromise or a suspected breach), call our 24/7 incident line at (289) 582-9930. Tell us who you are, who the client is, and whether counsel is already involved; if you are counsel, we will open the engagement in your name. For non-urgent referrals, readiness work or a conflict check, use the contact form.

IT Rapid Support has operated since 2018 from Vaughan (head office), Toronto and Vancouver, and carries $2 million in cyber liability insurance. We also provide expert-witness services where a matter proceeds to litigation.