Who Pays for a PR Firm After a Data Breach?

Most cyber liability policies include a crisis communications or public relations sublimit specifically for this. It typically covers PR firm fees, media monitoring, and in some cases reputation management, but usually requires you to use a vendor your insurer has pre-approved and to get consent before the spending happens.

This is coordinated through your breach coach as part of the overall response, not something you need to arrange separately. See Who Is On Your Incident Response Team? for how the PR firm fits into the broader response.