On April 8, 2025, the United States Department of Justice’s (DOJ) National Security Division’s (NSD) final rule (Final Rule) regulating certain sensitive US data transfers took effect. DOJ has made clear that it will take...more
In 2017, the New York Department of Financial Services (“NYDFS”) enacted a landmark regulation requiring financial services institutions such as banks and insurance companies in the state to meet substantial cybersecurity...more
11/8/2023
/ Banking Sector ,
Covered Entities ,
Cybersecurity ,
Cybersecurity Framework ,
Data Protection ,
Financial Institutions ,
Financial Regulatory Reform ,
Financial Services Industry ,
NYDFS ,
Regulatory Agenda ,
Regulatory Reform ,
Regulatory Requirements ,
Risk Management
Last month, Gurbir Grewal, the Director of the SEC’s Division of Enforcement, spoke at the Financial Times Cyber Resilience Summit. During the remarks, he outlined the importance of cybersecurity and signaled that the SEC is...more
7/11/2023
/ Amended Rules ,
Cyber Incident Reporting ,
Cybersecurity ,
Data Breach ,
Data Protection ,
Disclosure Requirements ,
Enforcement Actions ,
Financial Institutions ,
Incident Response Plans ,
Personal Data ,
Policies and Procedures ,
Publicly-Traded Companies ,
Risk Management ,
Securities and Exchange Commission (SEC)
On March 1, 2023, the White House released a new National Cybersecurity Strategy (the Strategy) documenting the Biden-Harris administration’s approach to improving cybersecurity across the digital ecosystem. The Strategy...more
On May 19, 2022, the Department of Justice (DOJ) issued revisions to its existing policy for charging offenses under the Computer Fraud and Abuse Act (CFAA) (2022 CFAA Policy). The revisions state that “good-faith” security...more
On March 15, 2022, President Biden signed into law the “Cyber Incident Reporting for Critical Infrastructure Act of 2022” (the Act) as part of the 2022 federal funding bill.
Among other things, the Act requires critical...more
3/18/2022
/ Biden Administration ,
Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) ,
Cybersecurity ,
Data Breach ,
Data Protection ,
Federal Breach Notification Standard ,
Homeland Security Cybersecurity & Infrastructure Security Agency (CISA) ,
New Legislation ,
Ransomware ,
Regulatory Reform ,
Regulatory Requirements
Last week, the SEC proposed rule amendments to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies. The proposed rules include an...more
In a speech to the Securities Regulation Institute conference last week, Chair Gary Gensler signaled the SEC may implement more stringent cybersecurity regulations, and in the meantime, would work to enforce existing...more
The Department of Justice (DOJ) announced this week a new Civil Cyber-Fraud initiative which will use the False Claims Act (FCA) to enforce government contract cybersecurity requirements. The initiative will be led by the...more