Commissioning a cyber incident investigation: deciding on scope, deliverables, and additional costs

The following is a fictional scenario. An anomaly occurred in the order and inventory system of Company A (a manufacturer with 300 employees preparing for a stock exchange listing), and Company B, the vendor to which operation and maintenance are outsourced, also reported suspected unauthorized access to the environment it uses for its work. Company A is considering commissioning Company D, an independent investigation provider, separately from the investigation conducted by Company B. It is not yet known whether any information has leaked or what the route of intrusion was.

Company A, Company B, and the other elements of the scenario in this article are fictional and used for explanatory purposes. They do not describe actual matters handled by our firm.

Situations in which an investigation has to be commissioned quickly

In the early stages of incident response, two demands arise at the same time: achieving restoration quickly and establishing what happened. If equipment is reset to prioritize restoration, information needed for the investigation may be lost. If the investigation is prioritized, the suspension of operations lasts longer. The restoration method and the preservation of evidence are considered together.

Furthermore, information that can be used in the investigation is lost over time. Log retention periods are limited, and overwritten logs cannot be recovered. NPO Institute of Digital Forensics' "Guidelines for Evidence Preservation" also address the effects of delays in starting to preserve evidence.

→ Initial response: preserving evidence and containment

In a company with separate departmental functions, the information systems department may first proceed with selecting and commissioning a provider for technical reasons, with the legal department becoming involved at the contract review stage. In that situation, check whether the purpose of the investigation includes the matters needed for reporting, explanations, and decisions on responsibility. If the investigation proceeds with its purpose limited to identifying the technical cause, the necessary facts have to be added later.

Checking the purpose of the investigation, what it will cover, and existing materials

Deciding on the purpose of the investigation first

The purposes of an investigation broadly fall into five categories.

1. To determine whether reporting to the authorities or notifying the individuals concerned is required
2. To provide explanations to business partners and corporate customers
3. To determine whether restoration can proceed
4. To consider where responsibility lies and prepare for claims for costs or recourse claims
5. To develop measures to prevent recurrence

Different purposes require different facts. For preventing recurrence, identifying the route of intrusion and vulnerabilities is central, whereas for explanations to a business partner, it is necessary to determine whether data entrusted to the company by that business partner was accessed.

Before commissioning the investigation, write down "what decisions this investigation is intended to make possible". This becomes the starting point for subsequently defining the scope and specifying the deliverables.

Care is needed here when deciding on reporting to the authorities and others. Even before the technical investigation has revealed the full picture, the facts known at that time are used to determine whether the situation qualifies as a reportable incident under the Act on the Protection of Personal Information, including where there is a possibility of a leak or other incident. If the company becomes aware of a reportable incident, a preliminary report is made using the information known at that time, without waiting for the technical investigation to be completed.

Checking the scope of the investigation and log retention deadlines

The systems to be investigated, the types of logs that can be obtained, and their retention periods are checked.

Care is needed where cloud services are used. This is because the range of information that can be obtained depends on the contract terms and service specifications. Information obtainable from the company's own equipment may be obtainable in the cloud only to the extent the provider makes it available. Reference information on this point has been published separately in connection with the 10th edition of "Guidelines for Evidence Preservation".

In Company A's case, the order and inventory system runs on infrastructure managed by the company, but some operations use a separate SaaS service. These two environments differ both in the range of information that can be obtained and in the procedures for obtaining it.

Checking materials already obtained

Before commissioning the investigation, the materials already on hand are checked. These include the results of the investigation already conducted by Company B, routinely collected monitoring logs, and information provided by other companies.

Duplicating investigation work increases costs, and if Company B's and Company D's investigations differ in their assumptions or scope, the results cannot be compared later.

→ Obtaining the necessary incident information from a vendor

Defining the investigation's scope, deliverables, and conditions for further investigation

Deciding what the deliverables will include

The report specifications are agreed upon when the investigation is commissioned. This article proposes the following four items to check regarding the deliverables. Discuss the level of detail and timing of delivery with the provider in light of the purpose and stage of the investigation.

• Facts that were established
• Facts that could not be established and the reasons why
• Assumptions and limitations of the investigation
• Methods used and scope covered

It is important to explicitly request the second item. Without it, the deliverables may not allow a later distinction between matters that were not investigated and matters that were investigated but could not be established. The scope and level of detail of the report's contents may also be adjusted according to its intended use and recipients, but care is taken to avoid creating a misleading impression of the scope or results of the investigation. This distinction matters both when providing explanations to business partners and when discussing responsibility.

Whether interim reports are needed and when they are to be delivered are also decided. If the process is designed to wait only for the final investigation report, decision-making in the meantime comes to a halt.

Sharing investigation constraints in advance

It may be impossible to establish certain matters because logs no longer exist, the retention period has expired, or the matters fall outside the scope of the investigation. Constraints anticipated at the time of commissioning are shared, and the method for reporting constraints identified after the investigation begins is also decided in advance.

Here, distinguish constraints arising from the scope or environment of the investigation from problems with its quality. Even where there are constraints on the scope of the investigation or the materials available, those constraints do not by themselves determine whether the investigation provider is liable. This is considered on a case-by-case basis in light of the services agreed upon, explanations of the constraints, how materials were preserved and obtained, how the investigation was carried out, and other factors.

Setting out the conditions for further investigation in advance

The conditions for proceeding to further investigation, the cost limit, and the person who approves it are set out in advance so that they can be checked when a decision on further investigation becomes necessary.

Deciding how the report may be used

Can the report received be provided to business partners, insurers, or the authorities? If the contract contains a clause on providing the report to third parties, its scope is checked. If the company plans to provide the report to others, agreeing on this at the time of commissioning provides greater certainty.

Simply sending a report or materials to a lawyer does not automatically exclude them from being subject to production or disclosure. This is because Japanese law does not provide a system allowing a blanket refusal to produce communications with a lawyer. Do not design the flow of materials on the assumption that "if they are handed to a lawyer, they will not have to be produced".

→ Submitting materials to the authorities and the treatment of communications with lawyers

Mapping the purposes of the investigation to the matters to be investigated

Matters to be requested from Company D	Decisions to be made despite unresolved matters	Decision deadlines or timing	Examples of responsible departments at Company A
Initial assessments of the information concerned and traces of access or other activity	Determining from the facts already known whether a preliminary report is needed, even if the full picture or cause has not yet been established	Promptly after becoming aware of a reportable incident*	Legal and information systems
Interim assessments of the impact on Company C	Considering contractual notification and the matters on which a response can be given, even if the restoration date or other details have not yet been determined	Contractual notification deadline / response date arranged with the business partner	Legal and sales
Methods and targets for investigating unresolved matters, and the materials needed	Determining the need for further investigation and its priorities, without putting reporting that is already necessary on hold pending further investigation	When the need for further investigation is identified (with retention deadlines for materials and other factors also considered)	Information systems and legal
Matters needed for the final report and matters that are still unknown	Proceeding with reporting within the deadline even if the investigation is incomplete, and managing the necessary supplementary reporting	By the deadline for the final report*	Legal and information systems

Note: These are illustrative entries for a fictional scenario. * The standard for a preliminary report is "promptly"; within approximately 3–5 days is the guideline. This does not mean that it is acceptable to wait that long. For a corporation, the starting point is when any of its departments becomes aware of a reportable incident. A final report is due within 30 days as a rule, or within 60 days for the category specified in Article 7, item (iii) of the Enforcement Rules for the Act on the Protection of Personal Information. If some matters remain unknown despite all reasonable efforts, the information already known is reported within the deadline, and the report is supplemented as soon as those matters become known. Insufficient information alone does not make every incident reportable.

Who approves commissioning and changes?

In this scenario, the information systems and legal departments check the investigation's scope, deliverables, and contract terms, and the authorized approver for the budget approves the commissioning of the investigation. If the scope or costs go beyond the conditions of approval, additional approval is obtained, after which the reasons for the changes are recorded.

→ Arrangements for an alternate in an authorized approver's absence and clarification of authority across the company

When an investigation is commissioned in an emergency, work may begin before the parties exchange the written contract. In that situation, key terms, such as the purpose of the investigation, its scope, deliverables, the method of calculating costs, confidentiality, and the permitted uses of the report, are checked with the counterparty through purchase orders, quotations, emails, or similar records, and terms already agreed upon and matters not yet agreed upon are recorded separately. Making a record and reaching agreement on the terms with the counterparty are separate matters.

If the company has cyber insurance, some policies make obtaining the insurer's approval before expenditure a condition of coverage for investigation and similar costs. Before commissioning the investigation, check the applicable policy terms and endorsements for conditions concerning the selection of the provider, costs, and communication procedures. Notification of the incident, approval of expenditure, and conditions for selecting the provider are separate matters.

→ Recording the necessity and amount of investigation costs

Keeping a history of requests, changes, and transfers of materials

The following items are recorded:

• The date and time of the request and what was requested
• How the equipment concerned or logs were obtained (who obtained them, from which equipment, and when)
• A list of materials provided and received
• What was changed and the reasons for the changes
• The approver

Of these, how the materials were obtained provides a basis for explaining later what the materials are. When the person who obtained the materials, the date and time they were obtained, and the equipment concerned are not recorded, explaining the materials' context takes more effort even if their contents are accurate.

If devices issued to employees or work emails are included in the investigation, separate consideration is needed for matters such as internal rules and obtaining consent.

→ Points to consider when investigating employees' devices and emails

When the conditions of the investigation do not match its purpose

In situations such as the following, we recommend considering the matter together with an analysis of the legal issues.

• When facts needed for reporting or explanations have been excluded from the scope of the investigation
• When only the results of the vendor's investigation can be obtained, and the company cannot carry out its own verification
• When there is disagreement with the counterparty over responsibility for investigation costs or the extent to which the report may be provided to others
• When the investigation results are expected to be used for later claims or recourse claims

There are aspects with which lawyers can assist at the stage of identifying additional matters to be checked for decisions on notification, explanations, and claims, with that identification based on the investigation provider's technical assessments.

→ Obtaining the necessary incident information from a vendor

→ Checking reporting and notification obligations and the overall response

Contact

Making an inquiry

Please let us know, as far as you are able, the status of commissioning the investigation; the matters you would like to confirm; and the points requiring decisions on the investigation's scope, deliverables, and costs, together with the deadlines for those decisions.

Contact Form

In your first message, please tell us the name of your company, the names of the parties involved and an outline of the matter. We will let you know whether we can advise after checking for conflicts of interest and similar matters. This form is not an emergency contact point, and we may not be able to review or reply to your message immediately after it is sent.

Related information

Related explainers and practice areas

A cyber incident at a vendor: requesting information to assess the impact on the company

Outlines additional information to request and conditions for sharing documents when using the results of the vendor's investigation.

Customer compensation and recovery costs after a cyber incident: records for liability allocation and recourse

Outlines records substantiating the need for expenditure such as investigation costs, its connection to the incident, and its amount.

Internal Misconduct Investigations and Response

Outlines investigation arrangements, measures for preserving evidence, and responses to the persons concerned when officers or employees are suspected of involvement in misconduct.

This article is provided for general informational purposes only and does not constitute legal advice on any specific matter. Please consult us regarding your specific situation. The content is based on the laws and regulations in effect as of the date of the last update.