Nothing gets the blood pumping quite like insurance talk. "The State of Data Breach Litigation: What You Need to Know and How to Protect Yourself" session delivered a few pro tips on how to handle the aftermath of a data breach.

The precise order of the steps they outlined may vary from jurisdiction to jurisdiction — hello, General Data Protection Regulation and California Consumer Protection Act — but sooner or later all breached parties should expect to encounter some tough questions about when to bring insurance carriers or even their own customers into the fold.

First things first: moderator Robert Brownstone, chairman of the electronic information management group at Fenwick & West, suggested that organizations top off their incident response plans with a one-pager that is basically a "in-case-of-emergency call list."

A company's go-to legal counsel should be right at the top. Panelist Roberta Anderson Sutton, owner of RAS Enterprise Risk Management Services, said that this could help to preserve attorney-client privilege around early conversations.

It's also generally a good idea to bring your cyber insurance carrier into the loop. Some companies are reluctant to make the call because they don't want to watch their rates balloon, but Mark Knepshield, senior vice president at McGriff, Seibels and Williams, said that carriers typically do not increase premiums following a breach.

Besides, there's always a chance that news of a cyber incident will leak anyway. "The worst way to notify a carrier is in the press," Knepshield said.

If you don't have a cyber insurance plan already locked down, there are some important things to consider before signing on the dotted line. Breaches aren't always discovered in a timely fashion, so Anderson Sutton advises getting retroactive coverage that dates back at least a year.

Devising a policy that still provides coverage in the event of human error—like an employee clicking on a phishing email—is also critical. Under those circumstances, being able to offer proof that simple preventive actions such as in-house security training were undertaken might help put the breach in a more defensible light with customers or board members.

Isis Miranda, an associate at London Fischer, said that some IT departments send out faux phishing emails to employees so that they can identify the employees who are prone to click and offer instruction.

Once the insurance stuff is out of the way, it may come time to start thinking about how and when to notify consumers or the effected parties. In some cases, a time frame may already be established by jurisdictional privacy or data breach laws. But if not, Sutton suggested waiting until a clearer picture of events has crystallized. Being forced to constantly revise or update an already embarrassing story in the press isn't a good look. "Too early notification costs almost as much as too late notification," she said.