NIS 2 Directive: Navigating the challenges of implementation, impact, and scope
The NIS 2 directive establishes a regulatory framework aimed at improving the level of cybersecurity across the EU.
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Why? |
|
|
|
Be prepared |
|
Risk Assessment
|
Toolkit
|
Key considerations |
||
Customer/individual rights
B2B relationships
|
Reputation management
Commercial
Regulatory issues
|
Privacy & data protection
Evidence
|
Response |
|
Crisis Team
|
Key Actions
|
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage?
Cybersecurity has been a mainstay of quarterly board agendas for years.
The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.
UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.
The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
AmericasMexico
United States
|
EMEACzech Republic Belgium Finland France Germany Italy Poland Sweden Turkey United Kingdom |
Asia-PacificAustralia Mainland China Japan
|
Key Take-Aways from White & Case Survey of Cybersecurity Disclosures
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
The statement advises on (1) when disclosure should be made under an Item 1.05 Form 8-K (Material Cybersecurity Incidents), versus another Item, such as Item 8.01 (Other Events), and (2) materiality determinations generally for cybersecurity incidents. The statement by Erik Gerding was provided in his official capacity as the Commission's Director of Division of Corporation Finance but notes that it does not necessarily reflect the views of the Commission and does not alter or amend applicable law.1
In summary, Director Gerding advises the following in his statement:
In addition, Director Gerding addresses the following:
The Director's statement explains that it is "not intended to discourage companies from voluntarily disclosing cybersecurity incidents for which they have not yet made a materiality determination, or from disclosing incidents that companies determine to be immaterial." Rather, the intent of the statement is to "encourage the filing of such voluntary disclosures in a manner that does not result in investor confusion" and it acknowledges the value of such voluntary disclosures to investors, the marketplace, and ultimately to companies. At the same time, the statement emphasizes that, as noted in the adopting release, "Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the company determines the materiality of an incident." As a result, the statement posits that "if all cybersecurity incidents are disclosed under Item 1.05, then there is a risk that investors will misperceive immaterial cybersecurity incidents as material, and vice versa."
White & Case's Public Company Advisory Group has been tracking Form 8-K cybersecurity incident disclosures since December 18, 2023, the effective date of the new rules. Between December 18, 2023, and May 23, 2024, 22 companies filed a total of 35 cybersecurity incident-related 8-Ks, either disclosing cybersecurity incidents or updating information on previously disclosed incidents:
For more information on our survey, including data on the actual impacts disclosed and timing of the disclosures, as well as survey information on annual report on Form 10-K/20-F cybersecurity disclosures, please contact the authors of this client alert.
Director Gerding's statement was issued in an environment that provides numerous challenges for public companies as they consider how, when and whether to disclose information about a cybersecurity incident. Companies are routinely subject to cybersecurity incidents, the vast majority of which are not significant, and beyond an item number for a Form 8-K,3 companies are weighing how, when and whether to disclose these incidents in the face of potential media scrutiny, notification requirements under various cybersecurity incident and data breach notification regulations, the potential for regulatory scrutiny and enforcement,4 threats of private action from the plaintiff's bar, as well as volatile developments with respect to the cybersecurity incidents, among other concerns. Accordingly, as companies consider their disclosures on cybersecurity incidents, the focus should remain on the controls necessary to determine whether an incident is material and on the substantive disclosures that will ultimately be helpful for investors and companies in light of the applicable facts and circumstances.
The following White & Case attorneys authored this alert: Maia Gez, Scott Levi, F. Paul Pittman, Michelle Rutta, Joel Cohen, Tami Stark, Danielle Herrick
1 See Footnote 1 of the statement, which also notes that "this statement, like all staff statements, has no legal force or effect: it does not alter or amend applicable law, and it creates no new or additional obligations for any person."
2 Note that three of the Form 8-Ks filed under Item 1.05 also filed Item 7.01 disclosure in the same Form 8-K.
3 The item numbers in a Form 8-K tend to be a technical aspect of disclosure and SEC form compliance. With regard to fundamental antifraud liability concerns, it is important to remember that the substance of the disclosure is the information being provided to investors, regardless of the item number used. For additional considerations, also see Instruction 3 of the Form 8-K and market practice for using the Item 5.03 item number even when not technically required.
4 See our client alert on the Solarwinds case. The defendants in the case have since filed a motion to dismiss the case and rejected the SEC's claims, arguing that its disclosure in a Form 8-K had disclosed the key facts about the attack only one trading day after the company learned of the incident.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2024 White & Case LLP