In the first 24 hours after a suspected cybersecurity incident, a law firm should activate its response plan, involve firm leadership and qualified technical support, preserve relevant evidence, and contain affected accounts or devices without destroying information. Protect client work and critical deadlines, document decisions and times, and have legal counsel assess notification and other obligations before communicating externally.
What should the firm do first when it suspects an incident?
Start by treating credible signs of account takeover, unexpected file changes, ransomware, unusual data access, or a suspicious payment instruction as an incident to assess. Do not wait for proof of data theft before escalating internally. A prompt, controlled response gives the firm a better chance to limit further access and understand what happened.
Notify the designated incident lead, managing partner or firm administrator, internal IT contact, and the firm's outside cybersecurity support if applicable. Keep the initial group small enough to coordinate effectively, while ensuring someone with authority can make business decisions. If the suspected issue involves a vendor or cloud service, contact the vendor through a known, independently verified support channel.
Use a communication method that is not suspected to be affected. If email or collaboration accounts may be compromised, do not rely on those channels to coordinate sensitive response details. Do not forward suspicious files or messages broadly; preserve them and share them only with people handling the investigation.
Record the first observed time, who reported the issue, what they saw, affected users or systems, and actions already taken. Keep the account factual. Separate confirmed observations from assumptions, and update the record as new information is verified.
The first 24 hours are for controlled containment, evidence preservation, and clear ownership, not hurried conclusions.
Takeaway: Escalate promptly, establish an incident lead, and create a reliable record before the response becomes fragmented.
How can the firm contain the incident without losing evidence?
Containment should be based on the observed risk and coordinated with the people responsible for the affected systems. A compromised account may require a different action from an encrypted workstation or an unusual sign-in alert. Avoid blanket changes that could interrupt critical systems or erase information needed to understand the incident.
- Identify what is affected. Note the user, device, application, mailbox, shared drive, matter system, remote access path, or vendor connection involved. Ask whether the activity is continuing and what evidence supports that assessment.
- Coordinate access controls. With technical support, consider disabling or restricting a suspected account, ending active sessions, or blocking a known malicious connection where appropriate. Preserve relevant logs and record who authorized the action and when.
- Isolate affected equipment when advised. If a device appears to be actively compromised, disconnecting it from networks may help limit spread, but do not power it off, wipe it, or reinstall software without guidance from the response lead. Those steps can remove useful evidence.
- Protect unaffected work. Confirm that unaffected users can continue essential work safely. Use established alternate procedures for court, transaction, client, or filing deadlines, and avoid moving sensitive matter files to unapproved personal accounts or devices.
- Pause risky changes. Do not delete suspicious messages, run cleanup utilities, restore backups over affected systems, or make broad password resets without coordination. Keep a record of necessary emergency actions.
A containment decision should state what risk it addresses, what business function it may interrupt, and how the firm will know whether the action worked. This keeps the response practical rather than treating every system as equally affected.
Takeaway: Contain deliberately, preserve the original evidence, and keep critical legal workflows in view.
What information and evidence should the firm preserve?
Preserve the original alert, suspicious email or message, relevant timestamps, account activity, endpoint alerts, system logs, and notes from people who observed the issue. Record the source and collection time for each item. Avoid editing original material; if a working copy is needed, keep the original intact and label the copy.
Build a concise incident timeline. Include when the first sign appeared, when it was reported, who was notified, what was affected, what containment steps were taken, and any changes in the observed activity. Record time zones when they are known. This timeline helps technical responders compare evidence and helps firm leaders understand decisions.
Identify potentially affected client or firm information without broadly opening or copying matter files. Technical responders can help determine which repositories, mailboxes, shared links, or accounts require review. Limit access to the response team and follow the firm's existing confidentiality, records, and litigation-hold processes.
Preserve relevant backup status and recovery information, but do not assume that a backup is clean or that restoration is the next step. The firm needs to understand the suspected entry point and scope, and determine whether recovered information is complete and trustworthy before using it.
Takeaway: Maintain a restrained, time-stamped record that supports investigation without unnecessarily exposing client material.
Who should the firm involve, and what should it communicate?
Firm leadership should coordinate decisions with internal IT, cybersecurity responders, outside counsel, relevant application or cloud providers, and the cyber insurer if the firm has coverage with an incident reporting process. Confirm who is authorized to contact each party. Keep a written log of notifications, instructions, reference numbers, and follow-up commitments.
Ask technical responders for plain-language updates: what is known, what remains unconfirmed, what containment is underway, what business services are affected, and what decision is needed from the firm. Ask them to distinguish evidence from working hypotheses. A useful update should help the managing partner or administrator make a business decision without requiring them to interpret raw technical logs.
Have qualified counsel assess legal, professional, contractual, insurer, and client communication obligations based on the facts and jurisdictions involved. Requirements can depend on the information, affected parties, and circumstances. Avoid announcing that data was or was not exposed until the investigation supports that conclusion. Do not treat a technical provider's findings as a legal determination.
Use a single approved channel for updates to attorneys and staff. Share only instructions they need to work safely, such as which account or service to avoid and where to report unusual activity. Do not speculate about cause, blame an individual, or circulate confidential incident details beyond the people who need them.
A customer review described a next-day follow-up to confirm that a door sensor issue had been resolved: "GDS followed up the next day to make sure the door sensor issue is resolved. That kind of attention shows real customer service." The incident response lesson is straightforward: assign an owner for follow-through, not only for the initial action. (Kawal, professional services)
Takeaway: Give each stakeholder a defined role, and communicate verified facts through a controlled process.
How should the firm approach recovery and the next steps?
Before restoring systems or returning an account to normal use, confirm who owns the affected service and what conditions must be met. Recovery may involve identity systems, email, document management, remote access, practice-management tools, client portals, and backups. A system that appears available is not necessarily ready for sensitive work.
Ask the response team to describe the recovery sequence, the evidence used to validate it, and any remaining limitations. Confirm that access controls and authentication are appropriate for the restored workflow, and check that users know how to report a recurrence. Keep a record of systems restored, decisions made, and outstanding risks.
Assess the firm's actual recovery options rather than relying on a backup status indicator. Confirm what data can be recovered, the relevant recovery point, dependencies, and who can authorize restoration. A documented disaster recovery plan can help clarify roles and priorities before the next disruption.
After immediate stabilization, review the incident with a focus on causes and control gaps: how access was obtained, whether credentials or sessions remain exposed, what information may have been reachable, and whether similar accounts or systems need review. An incident summary and prioritized recommendations can support follow-up work. A cybersecurity review can help the firm examine security practices and technology controls within an agreed scope.
For legal practices, the goal is not simply to bring every system back quickly. It is to resume client work with a clear understanding of what was affected, what remains uncertain, and who is accountable for closing the remaining gaps. GDS Technology provides incident response to investigate and coordinate a scoped response, including incident intake, scope and evidence review, containment coordination, investigation activities, recovery coordination, and an incident summary.
Takeaway: Restore in a deliberate sequence, verify the result, and assign owners to unresolved risks.
Frequently Asked Questions
Should a law firm shut down its entire network after a suspected incident?
Not automatically. A broad shutdown can interrupt client work and may not preserve the evidence needed to understand the incident. The firm should quickly involve its incident lead and technical responders, identify what appears affected, and make containment decisions based on the observed risk. Record the decision, its business impact, and the evidence supporting it.
Should staff delete a suspicious email or turn off an affected computer?
Staff should not delete suspicious messages, wipe devices, or power off potentially affected equipment unless the response lead instructs them to do so. Preserve the message and report what happened through a trusted channel. Technical responders can advise on safe containment while protecting information that may help establish the scope and sequence of events.
When should a law firm notify clients about a suspected cybersecurity incident?
There is no single notification timetable that fits every incident. The firm should preserve facts, determine what information and services may be involved, and have qualified counsel assess applicable legal, professional, contractual, and insurer requirements. Avoid making unverified statements about access or exposure. Keep a record of who approved any communication and what information it contains.
Can the firm restore from backup during the first day?
Possibly, but restoration should not be automatic. The firm and its technical responders should first consider whether the backup is suitable, what recovery point it represents, whether the affected environment is understood, and what dependencies must be restored. Confirm the recovery sequence and validation steps before relying on restored systems for confidential client work.
What should the firm review after systems are stable?
Review how the incident began, which accounts and systems were affected, what information may have been accessible, and whether similar access paths need attention. Compare the response record with the firm's existing procedures, identify control or ownership gaps, and assign each follow-up action to a named owner with a due date. Preserve the incident summary for future planning.
