Only as contractually obligated, y'all. And if it isn't your role in the IR plan, don't be a hero. You don't want to be that guy who got fired because they disclosed an incident to an unauthorized third party. Stick to the IR plan. Keep your cards close. Say only what's in the plan. Language matters.

If external IR support is needed, ideally you already have a reputable resource on retainer, a signed NDA with them, and a sanctioned engagement plan including secure OOB communication, but if not: 1. Ensure you have top level support and legal has approved this course of action 2. Find an IR resource that has a good reputation, reach out to them over a secure OOB channel of communication. Make sure you are actually in contact with the intended party and not your cyber adversary. 3. Sign mutual NDA's 4. Begin external IR support

When a cybersecurity incident happens, getting outside help fast is essential. First, figure out exactly what kind of expertise you need, whether it’s stopping a breach or investigating the issue. Having a go-to list of trusted experts ready can save you time and stress. Once you bring them in, give them all the details they need upfront so they can act quickly. Make sure everyone knows their role and what’s expected to avoid confusion. Keep communication open throughout the process to stay updated. After it’s all resolved, use their insights to strengthen your security moving forward.

Gather the information and keep a detailed log of what happened, including timestamps, systems affected, and any immediate actions taken. Assess what internal resources are available and where gaps exist. Look for trussed cybersecurity firms or consultants with a track record in handling similar incidents. Provide a detailed overview of the incident and specific areas to expert where you need assistance. Clearly define the scope of their engagement, including deliverables and timelines. Facilitate quick onboarding by providing necessary access to systems and information. Once the incident is resolved, conduct a debriefing session to discuss findings. Ensure all actions taken by external experts are documented for future reference.