Another court has made it harder for companies to keep the forensic reports that examine data breaches under wraps, including those reports that cyber experts expressly prepare for outside defense lawyers. On January 12, 2021, the U.S. District Court for the District of Columbia ruled that a cybersecurity firm’s report is discoverable, rejecting claims of work-product protection and attorney-client privilege. This article offers practical considerations and direction for companies seeking to preserve privilege amidst tightening judicial scrutiny. See “After Capital One Ruling, How Will Companies Protect Forensic Reports?” (Jun. 10, 2020).