Legal Liaison
Definition
The CSIRT role responsible for advising on legal obligations during an incident: evidence preservation requirements, breach notification deadlines, law enforcement engagement, and privilege considerations. The legal liaison ensures that response actions do not inadvertently destroy evidence or violate regulatory requirements.
- Team
- Computer Security Incident Response Team
- Advises on
- Evidence preservation, breach notification
- Also covers
- Law enforcement engagement, privilege
- Core goal
- Prevent response actions destroying evidence
Common questions
Why is a dedicated legal role needed during an active incident?+
Technical responders under time pressure can take actions, such as wiping a compromised system or restoring from backup, that are operationally sensible but destroy evidence needed for prosecution or regulatory defence, or miss a statutory notification deadline; the legal liaison flags these risks in real time.
What is meant by privilege considerations in this role?+
Certain incident communications and reports, if prepared at the direction of counsel in anticipation of litigation, may be protected from compelled disclosure. The legal liaison helps structure documentation and communications so that protection is preserved where applicable.
Related terms
- CSIRT
- Computer Security Incident Response Team. The organisational unit responsible for preparing for, detecting, coordinating, and resolving security incidents. Sometimes called CERT (Computer...
- FIRST
- Forum of Incident Response and Security Teams. A global membership organisation that sets standards for CSIRT capability and facilitates trusted information sharing...
- National CERT
- A government-operated or government-designated team responsible for coordinating cyber incident information at the national level. Examples include CERT-In (India), CISA (US), NCSC...
- Retainer Agreement
- A contract between an organisation and an external IR firm that guarantees a defined response time and service scope in exchange for...
- Team Lead
- The person who owns the incident response process during an active incident. The team lead coordinates analyst tasks, manages escalation to leadership,...