Session 1

That means people will show up. F**k. All right. Well, let's do it quick before people do. Okay. 3, 2, 1. Hey everybody. Andrew Morgan with the cyber call. Join with two my favorites, Chris Slayer, Sola Security. Eric Tills, uh, chief Legal Officer, formerly with Logic Callus. How are you guys doing? Fantastic. Doing great, Andrew. Great. Hey, so we're gonna be talking about the legal side of MSPs doing incident response.

Chris, real quick, um, we've talked a little about MSPs having incident response plans. Uh, let's talk about a Y and then Eric B, why do lawyers need to be part of your IR plan, Chris, starting with you? And so it's so crucially important now to have IR plans, uh, used to be an incident was something that we, you would see on an occasion, uh, but now it's becoming more regular and the, um, and the requirements to do it the right way by the book with the proper documentation.

And so, especially in the MSP world, everybody needs to be on the same page. So having a plan, having it well documented, having it well rehearsed, and uh, people throughout the organization knows to follow that plan and how to follow that plan is, uh, critically important both to you as an MSP to your company, as well as obviously to the client or clients that are affected by the incident. Yeah, it makes a lot of sense. Eric, talk to us on the legal side.

Why do lawyers need to be part of this? Yeah, the legal side is, is tough, Andrew, because depending on where the breach happened, where the the customers reside, what regulatory agencies are involved, whether you have to reach out to the, the state's attorney general, what forms you have to use, what you have to file, what you have to preserve, what you don't have to preserve, there's a lot of questions there.

And, um, you know, the, the lawyers can provide, uh, some, some quarterbacking of the process to make sure that you're following your incident re response plan accurately, um, to minimize your liability. Yeah, that's, that's, that's excellent. And then kind of wrapping things up here on, you know, telling people what we're gonna talk about, we're gonna talk about why MSPs Chris, uh, have gotten themselves in some legal troubles.

And this is the area where I just wanna get a few of your thoughts. And Eric, you wrap us up, but it's almost Eric, you, uh, you've shared, it's like the, the fox and the hen house. Um, Chris, give us your take and then Eric, close us out. So I, I would say to give the benefit of the doubt, some of 'em just feel that they're doing the right thing.

That, you know, for example, there are backups in place, so we'll just get those backups restored and get their client back up and running and we're off to the races. Uh, the second side I think is, is that, uh, for whatever reason, you know, maybe it's motivated by the fact that they see some professional services dollars, uh, on the, on the table.

Uh, they feel that they can kind of go handle this on their own and, um, and, and go down the path and, and do these steps and make some additional revenue off of it. Uh, not realizing, uh, all the different pieces, uh, that need to be in place and, and, and the risks, uh, to them and to their client, uh, for doing for doing it. Got it. Yeah, definitely. It's, it's gotta be a forensics led approach.

Every, every part of the IR plan has to be about process and preservation, not just achieving the end goal of getting the client back up and going up and going and keeping them happy. Um, it's, it's gotta, you've gotta preserve the information. So, so I think in wrapping things up here, Eric, it's like, Hey, if you're an MSP and you wanna be in this business, you really have to have your processes in place. You really have to understand forensics.

And you, one of the things we'll talk about too is when to keep things in your PSA and one things to move them out. So stay tuned. We'll look forward to seeing you all Monday, uh, here on the cyber call. Take care. Look forward to it. Thanks Andrew. Alright, fantastic. I think that'll be good. I agree. Alright, well I will let you guys go. Um, appreciate you joining me, uh, here. Looking forward to it and uh, I'll get an agenda out for you guys this weekend. Okay, fantastic. Thanks.

Loop on everything. Please. Will Do. Yeah, definitely. Thanks.