Choosing an incident response firm, and who does what after a cyber attack
Your IT provider, an incident response firm, a breach lawyer and your insurer all have a role after an attack. This guide explains which does what, and the questions to ask before you hire a responder.
Reviewed by the ITRS security team · Last updated
After a cyber attack, your IT provider restores systems, an incident response firm contains the attack and establishes what happened, a breach lawyer advises on privilege and notification, and your insurer decides what the policy covers. Choose a responder that preserves evidence before cleanup, documents chain of custody, can report to counsel and give expert evidence, and carries professional insurance. IT Rapid Support (ITRS) does incident response, digital forensics and managed IT for organizations in Toronto, the GTA and Ontario, 24/7 at (289) 582-9930.
Who does what
| Role | Main job | Typical deliverable |
|---|---|---|
Your IT provider or internal IT | Access, restoration, rebuilding devices, day-to-day fixes | Systems back in service |
Incident response and forensics firm | Containment that preserves evidence; scoping what was accessed or stolen; root cause | Timeline and findings report; affected-party analysis for notification decisions |
Breach lawyer (counsel) | Directing the investigation, privilege, notification and regulator decisions, client and contract communications | Legal advice; notifications and regulator reports |
Cyber insurer and broker | Coverage decisions, claim handling, vendor rules | Claim decision; approved vendor list where the policy has one |
Police and the Canadian Anti-Fraud Centre | Criminal investigation and case linking | Occurrence or file number |
IT company or incident response firm after a hack?
Usually both, with clear roles. Your IT provider knows the environment and is essential for access and recovery. An incident response firm adds what day-to-day IT is not set up for: preserving logs and disk images before anything is rebuilt, working out how the attacker got in and what they touched, and writing that up so an insurer, lawyer or court can rely on it.
The risk to avoid is cleanup that destroys the answer. Wiping a laptop, deleting a compromised mailbox or restoring servers before evidence is collected can make it impossible to show whether personal information was accessed, which may force wider notification than the facts would have required.
ITRS runs managed IT and incident response in one team. On an investigation we keep forensic work separate from operational IT, and where counsel directs the engagement, findings go to counsel.
Do you need a lawyer or a forensics firm?
They answer different questions, so serious incidents usually need both. The forensic firm establishes facts: what happened, when, and what data was reachable. The lawyer decides what those facts mean: whether there is a real risk of significant harm under PIPEDA, who must be notified, and how communications are worded. Many organizations have counsel retain the forensic firm directly so the work is done under counsel's direction; whether privilege applies is a legal question for counsel.
Ten questions to ask an incident response firm
Can we reach you at any hour?
Ask for the number, and whether a person answers it 24/7.
Will you preserve evidence before cleanup?
Ask how they collect logs, mailboxes and disk images, and whether they hash-verify what they collect.
Can I see a sample report?
A real report structure tells you more than a brochure. It should separate findings from opinion and state its limitations.
Will you work under our lawyer's direction?
Ask whether they will sign an engagement with counsel and route findings through counsel.
Are you acceptable to our insurer?
Some policies only cover panel firms or need the insurer's approval. Check the policy and call the claims line before signing.
Can you give expert evidence if this goes to court?
Disputes over a business email compromise loss or a departing employee can end up in litigation.
What insurance do you carry?
Ask for the type and amount of professional or cyber liability cover.
Do you know our platforms?
Microsoft 365, Google Workspace, your firewall and endpoint tools. Cloud investigations depend on knowing where each platform keeps its logs and for how long.
How do you bill?
Hourly or fixed, how scope is agreed, and how changes are approved.
Will you work with our IT provider?
A good responder gives your IT team clear instructions on what to preserve and what to change, in what order.
How IT Rapid Support answers those questions
Our incident line is answered 24/7 at (289) 582-9930. We preserve and hash-verify evidence before cleanup, publish sample reports, work under counsel's direction when counsel is retained, take expert-witness work, carry CA$2M in cyber liability insurance, and run Microsoft 365 and Google Workspace investigations as well as managed IT. Forensic work is billed by the hour against a written scope. We are headquartered at 7810 Keele Street in Concord (Vaughan), Ontario, with an office in Vancouver, and have done this work since 2018. If your policy limits you to panel vendors, call your insurer first.
FAQ
If money moved, your bank first. Then call the insurer's claims line early, because many policies have notice requirements and vendor rules. If you cannot reach them and the attack is active, containment cannot wait; tell the responder you are insured so they can work within the policy.
An agreement made before an incident that sets terms, contacts and onboarding in advance, so that on the day the responder already knows your environment. Ask what it costs, what it includes, and whether your insurer recognizes it.
Not necessarily. What matters is evidence handling, report quality, knowledge of your platforms, insurer acceptability and whether the people you speak to on day one do the work. Ask each firm the same questions and compare answers.
No. Confirm privilege, notification and insurance questions with your own lawyer and broker.
Related reading.
- PageFor counsel, insurers and brokersHow we work when breach counsel directs the investigation, what our reports give adjusters, and how brokers can help clients prepare before the next renewal.
- ServiceBusiness email compromise investigation and response in Toronto and OntarioSomeone got into a company mailbox and a payment went to the wrong account, or nearly did.
- ServiceRansomware response in Toronto and OntarioA plain sequence for a 20 to 200 person organization hit by ransomware: isolate, preserve, scope, recover, assess data theft and notify, with evidence kept intact for…
- GuideWorking with your cyber insurer after an incidentYou have had an incident and you have cyber insurance. This guide covers what to check in the policy, how vendor choice works, what evidence the claim will need, and the…
- GuideHow to instruct a digital forensics expertA practical guide for lawyers: what to check before retaining, what to put in the instruction letter, how to hand over evidence, and how scope drives both cost and the…
- PageIncident response FAQShort, plain answers to the questions people ask in the first hours of a cyber incident: whether to turn things off, whether to pay, who to tell, and how insurance and…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.