A company’s plan to sell a set of Ruth Bader Ginsburg action figures during the holiday season fails when a supplier fell victim to a ransomware attack. The company sues claiming the supplier didn’t meet the contracted delivery date because it did not have in place the cyber defenses required by the contract. The defense claims the forensic and penetration test reports are privileged. Are they?

Learning Objectives
1. Learn if and how the report of a forensic examination of a compromised system can be declared privileged.
2. Learn if using the forensic report to mitigate the vulnerabilities exploited in the attack would affect its privileged status.
3. Learn if and how a report of penetration test results can be declared privileged.