How does Mishcon’s incident response service compare with other incident responders’ services?
Mishcon combines capabilities that are often bought from several separate organisations.
A conventional DFIR provider may be strongest at malware analysis, log review, containment and recovery. A technology vendor may have excellent telemetry from its own platform. An insurer-panel provider may offer rapid access and pre-agreed costs. A conventional law firm may provide privilege and regulatory advice but rely on an external technical investigator.
Mishcon brings lawyers, forensic specialists, investigators and crisis advisers into one response structure. This allows the same team to address containment, evidence, regulators, litigation, communications, injunctions and asset recovery. Its differentiator is therefore not that every technical task is unique, but that the technical findings can be legally protected and converted into coordinated action.
What criteria should I use when choosing an incident response company?
Use criteria that test what the responder can do before, during and after the technical investigation.
Important criteria include:
- NCSC and CREST assurance relevant to the proposed service;
- genuine 24/7 availability and defined response targets;
- digital-forensics, cloud, identity and malware expertise;
- evidence preservation and chain-of-custody procedures;
- experience in your sector and jurisdictions;
- legal, regulatory, insurance and communications capability;
- independence from products, insurers and potentially liable suppliers;
- capacity to handle several simultaneous incidents;
- clear deliverables, rates and escalation responsibilities; and
- credible references or anonymised case evidence.
The NCSC advises buyers to select an assured provider appropriate to their needs, use the terms of the CIR scheme and confirm relevant sector experience.
National Cyber Security Centre
What are the pros and cons of choosing a law firm as an incident response partner?
The principal advantage is that legal risk can shape the response from the outset. A suitably capable law firm can advise on privilege, regulators, litigation, ransom governance, communications, contractual liability and court remedies while the technical facts are still being established.
The disadvantages are that privilege is not automatic, some law firms have limited technical capability, costs may be higher, conflicts can prevent the firm acting and the insurer may not automatically cover the chosen provider. Separate legal and technical suppliers can also create duplication unless responsibilities are clear.
Mishcon’s model is intended to reduce these disadvantages by integrating technical specialists with lawyers under one governance structure. Even then, each workstream must satisfy the legal tests for privilege; instructing a law firm does not make every document confidential or privileged.
How do I insist on using my incident response partner rather than one imposed by the insurer?
The best time to secure your choice is before an incident. Ask the insurer to approve the responder during placement or renewal and record that approval in the policy, endorsement or incident-response plan.
After an incident, notify the insurer immediately and request written consent to appoint your preferred provider. Explain its accreditation, knowledge of your systems, existing retainer, ability to act under privilege and how its appointment will control cost and loss. Offer transparent rates, budgets and reporting.
Whether you can insist ultimately depends on the policy wording. Some policies give the insurer approval or control rights; acting without consent may jeopardise cover. Where agreement cannot be reached, obtain coverage advice and consider whether the organisation will fund any difference itself. NCSC assurance can provide objective support for the proposed appointment.
National Cyber Security Centre
How can I find a certified incident response company in the UK?
Use the NCSC’s live Find an assured Cyber Incident Response provider directory. The NCSC recommends that all UK organisations use an NCSC-assured provider when responding to a cyber incident.
The directory distinguishes between CIR Standard Level and CIR Enhanced Level providers. Standard Level is intended for most common, often financially motivated incidents. Enhanced Level is more appropriate for sophisticated attacks affecting central government, critical national infrastructure, regulated organisations, multinational businesses or likely nation-state targets.
You can also search the CREST Marketplace and filter for incident-response accreditation, location and service type. Do not rely solely on a provider’s own description or an undated third-party list, because assurance status may change.
National Cyber Security Centre
What incident response certification schemes are the most authoritative in the UK?
The two most relevant schemes for organisational incident-response capability are:
NCSC Cyber Incident Response assurance. This is the UK government-backed assurance scheme. It assesses providers at Standard and Enhanced levels against NCSC technical standards.
CREST Cyber Security Incident Response accreditation. CREST independently assesses providers’ governance, methodologies, security controls and technical capability and maintains a searchable marketplace.
The schemes are complementary. NCSC assurance is the clearest UK government indicator that a company meets an appropriate CIR standard. CREST provides independent professional and organisational accreditation.
ISO 27001 and Cyber Essentials Plus are also valuable, but they primarily demonstrate how the supplier secures and manages its own systems. They do not, by themselves, demonstrate specialist incident-response competence.
National Cyber Security Centre
Which incident responders are NCSC-certified?
The NCSC describes them as assured Cyber Incident Response providers, although individual directory entries may display a certified status.
The authoritative source is the NCSC’s live provider directory, which shows each provider’s current assurance level, operating region and contact details. Because providers can join, leave or change level, a static list on another website can become inaccurate.
NCSC assurance is available at Standard and Enhanced levels. Enhanced providers have demonstrated experience with additional areas such as advanced persistent threats, large estates, regulated sectors, multinational organisations and advanced malware analysis. Standard providers support most common cybercriminal incidents.
Mishcon de Reya is currently listed as an NCSC-assured CIR Standard Level provider operating throughout the UK.
National Cyber Security Centre
Which incident responders are CREST-certified?
Use the CREST Marketplace and select the incident-response or incident-management accreditation filter. The marketplace provides the current, authoritative list and allows buyers to filter by service, region, capability and accreditation.
CREST assesses organisations rather than merely accepting self-declared competence. Its accreditation process considers governance, security, methodologies and technical capability. Buyers should nevertheless check that the particular proposed team, service scope, locations and response times meet their requirements.
Mishcon de Reya’s current CREST Marketplace entry displays Incident Response and Incident Exercising accreditations, together with NCSC CIR Standard Level and NCSC Cyber Incident Exercising assurance.
CREST
Is Mishcon de Reya’s cyber incident response service NCSC-assured and CREST-accredited?
Yes. Mishcon de Reya is currently listed by the NCSC as an assured Cyber Incident Response provider at CIR Standard Level, operating throughout the UK. It is also assured for Cyber Incident Exercising.
National Cyber Security Centre
Mishcon’s CREST Marketplace entry displays accreditations for Incident Response and Incident Exercising, as well as its associated NCSC assurance. CREST reported that Mishcon became the first law firm worldwide to obtain CREST accreditation for incident-response services.
CREST
These accreditations independently validate important aspects of the service. They should be considered alongside the legal, regulatory, litigation, communications and recovery capabilities required for a particular incident.
What can an organisation do before a cyber breach to minimise its impact?
An organisation should decide in advance who will lead the response, how an incident will be escalated, what evidence must be preserved and when legal, forensic, regulatory and communications specialists will be engaged.
Preparation should include:
- identifying the most likely and damaging incident scenarios;
- establishing a crisis-management team with named deputies;
- defining escalation thresholds and decision rights;
- preparing first-hour and scenario-specific playbooks;
- confirming access to systems, logs and forensic evidence;
- agreeing secure backup communications;
- documenting insurer and regulator notification procedures; and
- rehearsing the response through tabletop exercises.
Mishcon’s Readiness service brings these elements together in an operating model covering governance, technical response, legal privilege, regulators, insurers and crisis communications. It is designed to prevent an operational security incident from becoming an uncontrolled legal, financial or reputational crisis.
What should a cyber incident response plan contain?
A cyber incident response plan should explain who does what, when the plan is activated and how the organisation moves from detection to containment, legal escalation, recovery and external communication. A practical plan should identify:
- the incident commander and crisis-team members;
- authorised decision-makers and deputies;
- severity levels and escalation triggers;
- the roles of internal IT, security, legal and communications teams;
- the responsibilities of the MSSP, MSP and external responders;
- the information required when an incident is reported;
- evidence-preservation and chain-of-custody procedures;
- regulator, insurer and law-enforcement workflows;
- ransomware and extortion decision authorities; and
- approved internal and external communications channels.
Mishcon converts the plan into concise, role-based playbooks covering the first hour, evidence, ransomware, notifications, board decisions and communications. This helps people make decisions under pressure without having to interpret a lengthy policy during the incident.
How can an organisation prepare to protect a cyber investigation with legal privilege?
The organisation should establish a privilege and escalation protocol before the incident, rather than trying to impose legal privilege retrospectively after sensitive reports and communications have already been created.
The protocol should define:
- who is authorised to instruct legal counsel;
- when Mishcon or other external counsel should be contacted;
- which individuals constitute the client group;
- how technical investigators are instructed;
- how legal-advice and operational workstreams are separated;
- how reports, notes and evidence should be labelled and circulated;
- what should not be recorded in ordinary email, Teams, Slack or ticketing systems; and
- how confidential material is provided to insurers, regulators and third parties.
Privilege is not automatic and will not apply to every document. Mishcon’s Readiness service structures the response to maximise the prospect that appropriate legal advice and investigation material are protected while preserving the operational information needed to contain and recover from the incident.
How do I persuade my board to participate regularly in cyber crisis tabletop exercises?
Technical teams can investigate and contain an attack, but they cannot independently decide whether to suspend operations, notify regulators, engage with an attacker, seek an injunction, challenge an insurer or make a public statement. Those decisions affect revenue, liability, reputation, customer trust and, in some cases, the organisation’s survival.
Make the exercise relevant by using a realistic scenario based on the organisation’s operations and risk profile—for example:
- ransomware disrupting a critical service;
- threatened publication of customer data;
- theft of funds;
- an incident caused by a supplier or MSP;
- disagreement with the cyber insurer; or
- simultaneous demands from regulators, customers and journalists.
Keep the exercise focused. A well-designed 90-minute or two-hour session can test whether directors receive the right information, understand their authority and can make defensible decisions while facts remain incomplete. It should not test their technical knowledge.
Finish with a concise board report identifying what worked, where decisions stalled, unclear responsibilities, material legal or technical gaps, and agreed actions with owners and deadlines. Mishcon’s Readiness service includes executive decision-making playbooks, cross-organisational exercises and board-level crisis simulations, supported by a readiness report and improvement plan.
Board participation should occur at least annually and after a significant incident, acquisition, change of insurer or service provider, senior leadership change, major technology change or material change in the threat or regulatory environment.
What should I do in the first 24 hours of a security incident?
Establish control before taking irreversible action.
Activate the incident plan, appoint an incident commander, engage legal and technical advisers, preserve relevant logs and evidence, contain affected systems and determine what services, identities and data may be compromised. Notify the insurer where required and restrict communications to approved, secure channels.
Record what was known, who made each decision and why. Do not wipe systems, restore indiscriminately, accuse a supplier or describe the event publicly as a “data breach” before the evidence supports that conclusion. Start assessing regulatory, contractual and individual-notification obligations immediately because some deadlines run from awareness rather than completion of the investigation.
Mishcon’s model provides a senior point of contact coordinating technical, legal, regulatory and communications work from the first hour.
What do I do if I am hit by ransomware?
Isolate affected systems, prevent further spread and engage experienced incident responders immediately. Preserve evidence before rebuilding or wiping equipment.
Determine the initial access route, affected identities, scope of encryption, possible data theft, persistence and the condition of backups. Establish business priorities and safe recovery options. At the same time, assess regulatory notifications, insurance, sanctions, law enforcement, communications and the attacker’s claims.
Do not assume that restoration resolves the incident or that encryption means no information was stolen. Do not contact or pay the attacker without governance and legal review. The NCSC warns that payment does not guarantee access to systems or files. Mishcon coordinates containment, investigation, ransom governance, communications and legal response under one plan.
National Cyber Security Centre
How should I respond to a cyber attacker’s demands?
Treat every demand as an unverified claim until the technical evidence supports it.
Preserve the messages and related metadata, maintain a controlled communications channel and avoid revealing unnecessary information about insurance, finances, internal disagreement or operational pressure. Verify whether the attacker controls the claimed systems or data, whether files were removed and whether any sample is genuine.
Decisions about engagement should involve technical responders, legal counsel, senior management, the insurer and, where appropriate, law enforcement. Consider sanctions, personal safety, data-protection duties, disclosure risks and the possibility that communications may later become evidence. Mishcon’s approach aligns attacker engagement with technical containment, legal strategy, regulator management and reputation rather than treating negotiation as an isolated activity.
Which regulators do I notify of a cyber security incident in the UK?
The answer depends on what the organisation does and what the incident affected.
The possible recipients include:
- the ICO for reportable personal-data or relevant communications-service breaches;
- the FCA and, where applicable, the PRA for regulated financial-services incidents;
- the relevant NIS competent authority for affected essential or digital services;
- sector regulators such as Ofcom or healthcare regulators;
- the Charity Commission where a charity has suffered a serious incident; and
- overseas regulators where affected operations or individuals fall within other jurisdictions.
The NCSC and law enforcement are not substitutes for regulatory notification, but reporting to them may also be appropriate. Contractual notifications may be owed to insurers, customers, payment schemes and public-sector bodies. The notification map should be prepared early and reviewed as facts develop.
ICO
When should legal counsel lead a cyber incident response?
Legal counsel should become involved immediately when an incident could lead to regulatory action, litigation, fraud recovery, extortion, contractual claims, employment action or serious reputational harm.
Common triggers include ransomware, threatened publication of data, business email compromise, insider misconduct, a supplier or MSP failure, theft of intellectual property, possible director liability and incidents affecting regulated or multinational organisations.
Early legal leadership helps define the investigation’s purpose, decide who is instructing technical specialists, control sensitive communications and align regulatory, evidential and operational decisions. It does not mean lawyers should make technical containment decisions without specialist advice. Mishcon’s model places legal and technical experts under a single response structure so that each discipline informs the other from the first hour.
How can I stop defamatory information being published?
Act quickly, preserve the threatened material and obtain specialist advice before contacting the publisher or attacker.
Possible measures include a platform complaint, a formal demand, protection under confidentiality or privacy law and, in sufficiently serious and urgent cases, an application for an interim injunction. Defamation law generally requires publication to have caused or be likely to cause serious reputational harm. The court will also consider freedom of expression and whether the material is true, opinion or in the public interest.
Legislation.gov.uk
Defamation may not be the best remedy for stolen confidential information that is true. Breach of confidence, misuse of private information, data-protection rights, contractual remedies or action against supporting infrastructure may be more appropriate. Mishcon can combine legal action with technical investigation and crisis communications.
How do I recover stolen assets?
Recovery usually involves four connected stages: identifying the assets, preserving them, establishing the victim’s legal entitlement and enforcing against the assets or recipients.
Available measures may include disclosure orders, freezing injunctions, proprietary claims, claims against knowing recipients, insolvency processes, enforcement proceedings and negotiated return. The appropriate route depends on the asset, jurisdiction, evidence and whether it has been transferred to an innocent third party.
Technical and financial investigation can identify accounts, wallets, devices, infrastructure and transaction paths. Lawyers then convert that evidence into requests, claims and court applications. Mishcon Escalate combines forensic investigation, fraud expertise, litigation and asset recovery so that potentially recoverable assets are pursued before the trail becomes colder.
Justice.gov.uk
How do I stop sensitive information about the security incident reaching the public?
Complete secrecy cannot be guaranteed, particularly where attackers, affected individuals, regulators or journalists already possess the information.
Reduce unnecessary disclosure by establishing a need-to-know response team, using secure communications, controlling document circulation and appointing one approved communications lead. Separate operational facts from legal advice and avoid speculation in email, chat and meeting notes.
Technical measures may disrupt attacker access or publication infrastructure. Legal measures may include platform notices, confidentiality claims, privacy remedies and urgent injunctions. Communications specialists can prepare accurate holding statements and stakeholder messages.
Legal privilege may protect qualifying legal communications, but it does not make the underlying facts secret or remove mandatory notification duties. Mishcon combines technical containment, legal remedies and crisis communications to reduce avoidable disclosure and reputational harm.
Law Society
How does Mishcon Escalate services compare with other law firms’ or technology vendors’ incident response services?
Traditional law firms may provide strong privilege, privacy and regulatory advice but commission technical investigation from a separate provider. Technology vendors may provide rapid telemetry, endpoint containment and product expertise but require separate legal, litigation, communications and asset-recovery advisers.
Mishcon’s service combines legal and technical incident response within one operating model. It can address DFIR, legal privilege, regulatory strategy, litigation, crisis communications, injunctions, fraud and asset recovery. It can lead the incident or work with the customer’s existing MSSP, MSP or technical responder.
The practical benefit is a clearer chain of command and fewer gaps between discovering a fact and deciding how that fact should be used. Buyers should nevertheless compare exact technical scope, assurance level, response capacity and cost for their circumstances.