Forty eight hours. That’s roughly how long a legal team has to get a breach timeline under control before the evidence starts editing itself. Mailboxes keep syncing. Laptops keep overwriting files. Someone in IT reboots a server to “see if that fixes it.” By day three, nobody can prove what the system looked like on day one.
I’ve watched this play out in litigation support work, and the pattern barely changes. The companies that survive a breach lawsuit aren’t the ones with the cleanest security stack. They’re the ones whose counsel started treating the incident as a legal event in the first hour instead of the third week. Getting the preservation order right is the whole ballgame, and it usually means bringing in ediscovery platforms before anyone has finished drafting the press statement.
Here’s what actually matters in those two days, why the timeline has teeth, and how to spot the mistakes that are already happening in your own incident response plan.
Why the clock starts before you think it does
Most teams measure the breach clock from the moment someone spots the anomaly. Regulators measure it differently. Under the Federal Trade Commission health breach rules, covered entities have 60 days to notify, and that window opens on the discovery date, not the date someone finally confirms scope. Legal exposure starts accruing earlier than most incident response plans assume.
That gap is where cases get lost. Your security team is thinking in terms of containment. Your general counsel is thinking in terms of notice obligations. Neither of them is thinking about the fact that a forensic image taken at hour 40 may already be useless because the attacker’s foothold was overwritten at hour 12. If nobody owns preservation in that first shift, you end up in court two years later arguing about a log file that no longer exists.
The uncomfortable truth: your incident response vendor probably won’t save you here. Forensic firms are excellent at figuring out what happened. They are not built to think about how a judge in a different jurisdiction will read their report. That’s a legal judgment, and it needs to land on a lawyer’s desk fast.
The three decisions that get locked in early
Nearly every breach dispute traces back to a handful of calls made in the compressed early window. These are the ones I would want handled before anyone goes home.
- Who holds the privilege. If an outside firm engages the forensic vendor, privilege arguments get stronger. If IT hires them directly, you may be handing opposing counsel a roadmap. Decide before the contract gets signed, not after.
- What gets imaged first. Endpoints, identity logs, and email archives in that order for most intrusions. The attacker’s persistence mechanism lives on endpoints, and that’s what gets wiped when someone runs a “cleanup” script.
- Who talks to whom. One channel for the incident, one channel for legal strategy. Blurring them means your candid internal assessment ends up in a production set.
None of these are technical decisions. They’re legal posture decisions that happen to require technical execution. The teams that stumble usually treat them as IT tasks and hand them to whoever happens to be on call.
What good preservation actually looks like
A defensible hold isn’t a memo. It’s a chain of custody you can walk a court through two years later without gaps. The National Institute of Standards and Technology publishes incident response guidance that maps the technical side well, but the legal overlay is on you.
Here’s the practical version. Preserve the systems, not just the documents. That means forensic images of endpoints and servers, not just exports of the files someone thinks are relevant. Then preserve the identity layer: authentication logs, VPN sessions, and the endpoints that touched the compromised accounts. Attacker dwell time matters more than data volume in most investigations, and the identity logs are where dwell time shows up.
Capture the communications around the response itself. Slack threads, email chains, and incident bridge recordings are all discoverable, and a court will read them to understand what you knew and when. Nobody likes this part. But a response record that shows a coherent, timely decision process is worth more than a perfect one that appears to have materialized overnight.
A five step runbook for the first shift
This is the sequence I’d push any legal team to have printed and stuck to a wall, because nobody reads a 40 page playbook at 2 a.m.
- Assign a legal owner. One name, reachable by phone, with authority to engage vendors and approve spend without a committee.
- Issue the hold in writing within hours. Include every custodian you can reasonably identify, and over-include on purpose. Narrowing later is easy. Explaining an omission is not.
- Engage forensics under privilege. Outside counsel contracts the firm. This single drafting choice shapes everything that follows.
- Freeze the systems. Stop reboots, stop reimaging, stop “cleaning up.” Every one of those actions destroys evidence someone will ask about.
- Start a decision log. Time stamped, one line per decision, who made it and why. This document will do more work for you than any expert report.
That last one is the cheapest step and the one most teams skip. A decision log costs nothing to keep and it answers the question every plaintiff’s counsel asks: what did you know, and what did you do about it?
The mistake I see most often
Companies treat the breach as a security failure and the lawsuit as a separate problem. They aren’t separate. The breach response is the case. Every email your CISO sends, every retention decision your IT team makes, every hour you delay engaging counsel becomes an exhibit.
I’d rather see a legal team over-involved in the first day than perfectly efficient and absent. The cost of over-preservation is some storage and review noise. The cost of under-preservation is an adverse inference instruction, and that’s not a fight you want to have in front of a jury.
What’s more, the Department of Justice has made clear in its charging guidance that a company’s response posture affects how prosecutors assess cooperation. That guidance isn’t a courtroom rule, but it shapes how a case gets framed long before trial, and it’s another reason the record you build in the first shift has consequences far beyond civil discovery.
Start with the runbook, not the vendor
The teams that come out of a breach intact almost never have better technology. They have a named legal owner, a hold template ready to send, and a decision log they started before they knew how bad it was. Three boring things, executed in the first shift.
If your incident response plan doesn’t name who engages the forensic vendor, that’s the gap to fix this week. Before the next anomaly, before the next 2 a.m. call, before the next laptop gets reimaged by someone trying to help. Pull the plan out, read the first page, and ask yourself who’s on the hook at hour one. If the answer isn’t obvious, you’ve just found your problem.
