Article
Why your gap assessment may be disclosable
The difference between a vendor report and privileged legal work product.
Published
Most companies commission a security gap assessment for the right reasons: to find weaknesses and fix them. Few ask what happens to that report on the day something goes wrong.
A report is evidence
A gap assessment written by an IT or GRC vendor is an ordinary business record. It lists, in your own name, every control that was missing on a given date. In a coverage dispute with your insurer, a regulator's inquiry or a class action after a data breach, the other side can ask for it, and the report becomes their best exhibit: proof that the company knew.
The irony is sharp. The more thorough the assessment, the more damaging it can be.
What privilege protects
Attorney-Client Privilege protects confidential communications made for the purpose of legal advice. Work prepared at counsel's direction in order to give that advice, including technical findings, can share that protection. The key questions are who commissioned the work, for what purpose, and how it was handled:
- Engaged through counsel: the assessment is ordered by the lawyer, to advise the company on its legal and insurance position.
- Purpose is legal advice: not a routine IT deliverable or a certification exercise.
- Kept confidential: the findings are shared on a need-to-know basis and not circulated as an ordinary report.
Privilege is not a label you add to a cover page. It depends on how the engagement is structured from the first day, and its limits vary by jurisdiction.
Fix the gaps, keep the record clean
A privileged review does not mean hiding problems. It means you can look at them honestly, fix them, and decide with counsel what has to be disclosed, for example on the next proposal form, without creating a document that is later read against you.
That is why every CyberSure review is run directly under legal privilege, led by Adv. Ziv Onn.
This article is general information, not legal advice.