--- title: Does Your Housing Organization Need a Cyber Forensics Retainer? description: Time is of the essence after a cybersecurity breach. Having a firm on retainer allows the investigation and remediation to begin earlier. image: https://blog.haigroup.com/hubfs/Imported_Blog_Media/iStock-1131198259.jpg --- [Skip to content](https://blog.haigroup.com/does-your-housing-organization-need-a-cyber-forensics-retainer#main-content) [![hai-logo-KO-256px](https://blog.haigroup.com/hs-fs/hubfs/hai-logo-KO-256px.png?width=256&height=57&name=hai-logo-KO-256px.png "hai-logo-KO-256px")](https://www.haigroup.com/) - SEARCH - [Cybersecurity](https://blog.haigroup.com/tag/cybersecurity), - [Risk Management](https://blog.haigroup.com/tag/risk-management) # Does Your Housing Organization Need a Cyber Forensics Retainer? ![](https://blog.haigroup.com/hubfs/Imported_Blog_Media/iStock-1131198259.jpg) - July 31, 2024 ![HAI Group](https://blog.haigroup.com/hubfs/HAI%20Group%20Logo/Pinwheel_blue.jpg) [HAI Group](https://blog.haigroup.com/author/hai-group) [\< Back to Resource Center](https://blog.haigroup.com) Even the best-prepared organization is vulnerable to cybercriminals seeking to hold data and systems hostage in exchange for payment. [Ransomware attacks](https://www.knowbe4.com/ransomware), as they’re known, impact every industry. Since 2016, the U.S. has experienced around [4,000 ransomware attacks daily.](https://www.justice.gov/criminal-ccips/file/872771/download#:~:text=On%20average%2C%20more%20than%204%2C000,risk%20posed%20to%20your%20organization.) No organization is immune. Among your priorities after a cyberattack is finding the root cause and preventing further harm. Most organizations don’t have the resources or expertise to diagnose a cybersecurity threat alone. That’s where a third-party cyber forensics firm comes in. Forensics firms specialize in collecting digital and physical evidence to uncover what happened during a cybersecurity breach. After a suspected breach, a forensics firm’s primary objectives are to: - investigate the source of the breach and contain potential threats; - identify the extent of sensitive data accessed by cybercriminals; and - fix vulnerabilities to prevent a similar breach from happening again. Time is of the essence after a cybersecurity breach. Having a firm on retainer allows the investigation and remediation to begin earlier. If you wait too long to engage a forensics firm after a potential breach is identified, the evidence could be gone already, and your organization (and its data) will remain at risk. Every state has a law requiring[notification of security breaches i](https://www.ftc.gov/tips-advice/business-center/guidance/data-breach-response-guide-business)nvolving personally identifiable information (PII), such as Social Security numbers. Refer to your state-specific breach notification law for details. A forensics firm will attempt to determine if cybercriminals accessed any PII, and if so, whom the organization may need to notify based on state regulations. Keeping a forensics firm on retainer can also alleviate concerns from internal IT staff that a breach investigation by a third party will be slower than one conducted by in-house teams. Having a relationship with a forensics firm before an incident allows the firm to build trust and familiarity. This familiarity can help streamline the investigation process. The firm also serves as an independent investigator, giving all parties involved confidence in an objective review of the breach. ## What does a forensics retainer typically cover? A retainer can cover different aspects and time frames depending on whether you’re dealing with the forensics firm directly or engaging a firm through external legal counsel (the next section covers why external legal counsel is recommended). The typical retainer should cover at least 48 hours of investigation time, Moore said. The scope of the investigation generally includes determining the source and severity of the breach, identifying what information was accessed, preserving evidence, and containing threats. Depending on your organization’s needs, the retainer can cover a lengthier investigation with training, exercises, and other benefits, Moore noted. Consult with your internal legal counsel before entering into any agreement with an external service. ## Selecting and managing your cyber forensics firm (with legal privilege in mind) When selecting a forensics firm, Moore suggests managing the process through external legal counsel for three reasons: - External counsel usually has experience hiring and working with qualified forensics firms. - Managing the process through external legal counsel helps maintain legal privilege. - External counsel can prepare and maintain the investigation timeline to help answer detailed questions with consistency and accuracy. In the event of a cybersecurity breach, your organization may face various legal risks. If a lawsuit is filed, plaintiffs may request that your organization turn over all written materials related to a forensics investigation as part of the discovery process. Written communications between internal counsel and a forensics firm are considered part of the ordinary course of business and typically can’t be withheld. Precedent has established internal legal counsel as part of the organization, negating attorney-client privilege. Meanwhile, any written communications with external legal counsel (and the consultants they refer, such as forensics experts) enjoy attorney-client privilege because the law firm was retained for legal advice or in anticipation of litigation. “Having external counsel helps protect the organization from litigation and ensures that privileged and confidential emails remain that way,” Moore said. A detailed timeline of events and communications, including crucial forensics details, should preferably be maintained and managed by external legal counsel. “Just like any litigation activity, computer forensics activity must follow the same evidentiary handling process,” Moore said. Contact our Risk Control and Consulting team for more resources and answers to your housing organization’s risk-related questions. [![Contact My Risk Control Consultant](https://no-cache.hubspot.com/cta/default/20790879/interactive-185612556070.png)](https://blog.haigroup.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJmJ2J1VKD8U%2F9I%2BuaT5QohRSNrCJr6aPEInOGyM%2B8RIQLuUvmOoX7mg6OTnbW0M%2FbfWGF3PrvuvcfbL9eqsdBVD%2Bms042YBN2tKzk0G%2FXp4yfgB9EWfEWnLdc9%2Bs1wnd0KKbAMAyHX3Mnqep6kEftqB2cekf%2BgtwB76Y6dL0tFxsA1wlxZdVh4MqsbbuVviHJbO7%2B13nR%2FCXIi&webInteractiveContentId=185612556070&portalId=20790879) Interested in Working With HAI Group? Our Account Services team is ready to assist you. [![Contact Account Services](https://no-cache.hubspot.com/cta/default/20790879/interactive-187801916207.png)](https://blog.haigroup.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLd4PaEISfHvAyJhcdfYczX56iGZ%2B25Iq9Zd0JDNC3%2FkEey7In5zljLi7pX14T2VGzYEUfKfHKsJqzIYUOfO8pcb3Y2ZafOoRJZNMjQtRvvAi72ZbpjZoAGM%2BqVCwrnRweh%2BF0kgBdyHJ25wvfnlE9c%2Bt5bk1lDMhibY0i1%2BIUppLLxkFnY%2FxQ4dKQU7JYJknxa9C9iubo%2FHYbbAucKei6Rz4qV48UbHx9dJb4VOx61h40z8OcF4t1PYpyhFeewDw%3D%3D&webInteractiveContentId=187801916207&portalId=20790879) --- *This article is for general information only. HAI Group® makes no representation or warranty about the accuracy or applicability of this information for any particular use or circumstance. Your use of this information is at your own discretion and risk. HAI Group® and any author or contributor identified herein assume no responsibility for your use of this information. You should consult with your attorney or subject matter advisor before adopting any risk management strategy or policy.*  *HAI Group® is a marketing name used to refer to insurers, a producer, and related service providers affiliated through a common mission, management, and governance. Property-casualty insurance and related services are written or provided by Housing Authority Property Insurance, A Mutual Company; Housing Enterprise Insurance Company, Inc.; Housing Specialty Insurance Company, Inc.; Housing Investment Group, Inc.; and Housing Insurance Services (DBA Housing Insurance Agency Services in NY and MI).* The information presented is for general reference only. HAI Group makes no representation or warranty about the accuracy or applicability of this information for any particular use or circumstance. Your use of this information is at your own discretion and risk. HAI Group and any author or contributor identified herein assume no responsibility for your use of this information. You should consult with your legal, professional or subject matter advisor before implementing any new strategy or policy. HAI Group® is the registered trademark of Housing Authority Risk Retention Group, Inc. and its related companies. For a complete list of HAI Group companies, visit www.haigroup.com. Products or services may not be available in all jurisdictions. Certain property and casualty coverage may be provided by a risk retention group or a surplus lines insurer or by a third party. Risk retention groups and surplus lines insurers do not participate in state guaranty funds and their insureds are not protected by such funds. Don't Miss This ## Related Content [![](https://blog.haigroup.com/hubfs/RealEstateBusinessReview-3.png)](https://blog.haigroup.com/2026-public-and-affordable-housing-insurance-company-of-the-year) - July 31, 2024 ### [HAI Group Named 2026 Public and Affordable Housing Insurance Service Company of the Year](https://blog.haigroup.com/2026-public-and-affordable-housing-insurance-company-of-the-year) July 17, 2026 Real Estate Business Review Magazine recently recognized HAI Group as the 2026 Public and Affordable Housing Insurance... [Read more](https://blog.haigroup.com/2026-public-and-affordable-housing-insurance-company-of-the-year) [![](https://blog.haigroup.com/hubfs/Legal%20-%20gavel%20and%20home.jpg)](https://blog.haigroup.com/claims-corner-navigating-legal-risks-in-public-housing-security) - July 31, 2024 ### [Claims Corner: Navigating Legal Risks in Public Housing Security](https://blog.haigroup.com/claims-corner-navigating-legal-risks-in-public-housing-security) July 9, 2024 Some housing agencies employ security personnel directly or through third-party services to ensure resident safety.... [Read more](https://blog.haigroup.com/claims-corner-navigating-legal-risks-in-public-housing-security) [![](https://blog.haigroup.com/hubfs/Imported_Blog_Media/Insurance%20Endorsements-1.png)](https://blog.haigroup.com/hai-group-explains-insurance-endorsements-for-public-and-affordable-housing-providers) - July 31, 2024 ### [HAI Group Explains: Insurance Endorsements for Public and Affordable Housing Providers](https://blog.haigroup.com/hai-group-explains-insurance-endorsements-for-public-and-affordable-housing-providers) July 12, 2024 In the public and affordable housing industry, flexibility is key to ensuring that insurance coverage aligns with your... [Read more](https://blog.haigroup.com/hai-group-explains-insurance-endorsements-for-public-and-affordable-housing-providers) ![HAI Group](https://blog.haigroup.com/hubfs/raw_assets/public/Thrifty%20child/images/hai-logo-footer.png) - [Online Privacy Policy](https://www.haigroup.com/privacy-policy/) - [California Privacy Rights](https://www.haigroup.com/wp-content/uploads/2024/11/HAI-Group-CA-Privacy-Rights-Notice-1.pdf) - [Terms of Use](https://www.haigroup.com/terms-of-use/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "HAI Group", "url" : "https://blog.haigroup.com/author/hai-group" }, "dateModified" : "2025-04-04T18:29:10.537Z", "datePublished" : "2024-07-31T15:00:00.000Z", "headline" : "Does Your Housing Organization Need a Cyber Forensics Retainer?", "image" : [ "https://blog.haigroup.com/hubfs/Imported_Blog_Media/iStock-1131198259.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.haigroup.com/does-your-housing-organization-need-a-cyber-forensics-retainer", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.haigroup.com/hubfs/HAIGroup%20PMS2186C%20400X100-300dpi-1.png" }, "name" : "HARRG" } } ```