Law enforcement contact decision tree

Overview

When to call law enforcement depends on jurisdiction, sector, data types, and ransom dynamics—legal counsel approves contact framing.

Triggers to consider notification

• Critical infrastructure, regulated PHI/financial data, terrorism/nation-state attribution hints, physical threat, extortion with law enforcement interest.
• Insurance policy may require timely report to FBI/Cyber portal—verify wording.

Before dialing

• Preserve logs and timelines; avoid destroying evidence during panic rebuilds.
• Single narrative contact person—usually general counsel or outside counsel.

Process

• Local vs federal path varies; document case number received.
• Do not promise employees confidentiality that conflicts with legal duty to cooperate—HR + counsel wording.

International

GDPR or foreign data may restrict what you share—DPA review.

MSP role

Facilitate technical facts, attend bridged calls if contracted; do not make legal admissions on client’s behalf.

After

Update IR plan with lessons from agency interaction—some cases move slowly; manage executive expectations.