Five Questions to Answer Before the Countdown Starts

Most firms have a technical recovery plan. Backups run, someone knows how to restore them, and there's an IT provider to call.

What they usually don't have is a tested answer to the business questions that arrive at the same moment. In my experience, those are what decide how the following week goes.

Over the past few weeks I've written about a campaign that SOCRadar and Halcyon attributed to INC Ransom, in which twenty-four U.S. law firms were reportedly given individualized extortion websites with publication deadlines and claims about exposed client data, apparently designed to reach the firms' clients. Ten of those firms later appeared on the group's leak site. SOCRadar was careful to say that absence from the site proves nothing about payment, and I'll repeat that caution. I have no information about what any of those firms decided.

What outlasts this particular campaign is the model: an incident that combines operational disruption with direct pressure on clients. These are the five questions I ask leadership before that happens, and what I'm looking for behind each one.

1. Who has authority, and can they actually use it?

Every plan should name an incident leader, alternates, and who can engage forensics, notify the insurer, retain breach counsel, approve spending, and take systems offline.

Here's what I look for underneath that: whether the people with authority match the people with access. It's common to find that the managing partner can authorize shutting down email, but the only accounts that can actually do it belong to an outside vendor or someone who left the firm. I also check whether there's an emergency administrator account that works when the normal sign-in doesn't, and whether anyone knows where it is.

Authority on paper that can't be exercised in practice is just a list of names.

2. How will you communicate when your systems are the problem?

This one is where looking at the firm from an attacker's side changes the answer.

I ask where the incident response plan is stored. Very often it's in the firm's email, SharePoint, or document management system, meaning an attacker with a foothold can read the firm's playbook before the firm opens it. The same goes for the contact list leadership would use to coordinate.

So what I look for is a communication path that doesn't run through anything that might be compromised: current phone numbers for staff, vendors, the insurer and breach counsel, stored somewhere reachable when the network isn't, and a way for staff to verify that instructions really came from leadership. Impersonating a managing partner during an incident is a real tactic, and it works because everyone is already unsettled.

3. What has to keep running, and by when?

Not every matter carries the same urgency. Court deadlines, closings, and trust account disbursements have consequences that don't pause for an outage.

What I do here is map the firm's deadlines for the next ninety days against the systems each one depends on. That turns "we need our systems back" into a specific order of recovery.

Then I look at whether the backups can actually meet that order. A test that confirms the backup files exist hasn't tested anything that matters. The question is how long a real restore takes, and whether it finishes before the deadline that depends on it.

4. What will clients be told, and how will they know it's you?

When attackers contact clients directly, client communication stops being a follow-up task and becomes part of the response.

Firms need a process for separating what's confirmed from what's still under investigation, and for deciding what needs breach counsel's review before it goes out. Lawyers also have professional obligations of their own here; the ABA has issued guidance on attorneys' duties to clients after a data breach, and breach counsel should be part of these decisions from the start.

The part I focus on is verification. Once client contact details are stolen, criminals impersonate the firm. The following will begin to appear: updated payment instructions, fake settlement details, and requests for more information. Clients need to know in advance how the firm will confirm genuine instructions, because guidance that arrives during the incident is much less convincing.

5. Could you show your preparation was reasonable?

After an incident, the firm may need to explain its decisions to clients, insurers, or regulators.

This is where I check one thing most firms never connect to the rest: their cyber insurance application. Carriers ask firms to attest to specific controls, such as multi-factor authentication on remote access, tested backups, and endpoint protection. Those forms are often completed by someone who wants to answer yes. I compare what the firm attested to against what's actually configured, because finding that gap during a claim is far worse than finding it now.

Beyond that, what demonstrates reasonable preparation isn't a list of products. It's a record: dated decisions from leadership, timed restore tests, training, and evidence that known weaknesses were fixed in order of business impact.

How I test all five

The way to test this without disruption is a tabletop exercise: leadership walks through a realistic scenario with incomplete information and a clock.

When I run one, I include the part most exercises skip. Midway through, a client calls having already seen the attacker's version of events. That single moment tends to expose more gaps in authority, communication, and client handling than the rest of the exercise combined.

A couple of hours is enough to find most of the problems. The value is that you find them while you still control the timing.

No firm eliminates cyber risk. What preparation buys you is time, options, and reliable information at the moment someone is actively trying to take all three away.

Could your leadership team answer all five of these questions today, without relying on assumptions?

---

Sources: SOCRadar: INC Ransom Targeted 24 Law Firms, but Only 10 are Listed; Halcyon: INC Ransom Group Mounts Rapid Campaign Against Law Firms