Who Is On Your Incident Response Team After a Data Breach?

The Breach Coach

A breach coach is a privacy or cyber attorney, usually from your insurer’s pre-vetted panel, who acts as the first responder alongside the carrier’s claims team. According to Travelers and CoverLink, the breach coach directs the forensics investigation, determines which state and federal notification laws apply and sets the deadlines for each, coordinates the PR firm and any other vendors, and structures the engagement so the investigation’s work product falls under attorney-client privilege.

The Forensics Firm

A digital forensics team, typically also from the insurer’s approved vendor panel, investigates what actually happened: how the attacker got in, what they accessed, and whether they are still inside your systems. See The Forensic Investigation Process for the detail on what this work actually involves.

The Claims Adjuster

Your insurer assigns an adjuster who manages the claim itself, including approving costs, coordinating with the breach coach, and ultimately processing your proof of loss and payment.

The PR or Crisis Communications Firm

Most cyber policies include a crisis communications sublimit covering a PR firm’s fees for managing public messaging, media monitoring, and, in some cases, reputation management. This usually requires using an insurer-approved vendor and getting consent before spending.

Internal Roles: IT, HR, Legal, and Management

The FTC’s guide specifically calls out assembling an internal team spanning forensics, legal, IT, operations, human resources, and communications, with management involved throughout. Your internal IT team is often the first to notice something wrong and plays a critical role working alongside the forensics firm rather than being replaced by it.

Why Privilege Matters

Having the breach coach direct the forensics engagement, rather than hiring a forensics firm directly, is a deliberate structure. It is designed to protect the investigation’s findings under attorney-client privilege, which can matter significantly if litigation follows.