Most mid-market organizations now have a written incident plan. Fewer have tested it with legal, communications, and the board in the same room. Fewer still have vendor contracts that require timely notice and meaningful cooperation.
When an incident hits, the first 48 hours are operational and legal at once: contain, preserve, notify, and decide what can be said publicly. Counsel who arrive after the forensic report is finished are already late.
We work with clients before the event — playbooks, tabletop exercises, and contract language — so the response is rehearsed rather than improvised.