NIS 2 Directive: Navigating the challenges of implementation, impact, and scope
The NIS 2 directive establishes a regulatory framework aimed at improving the level of cybersecurity across the EU.
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Why? |
|
|
|
Be prepared |
|
Risk Assessment
|
Toolkit
|
Key considerations |
||
Customer/individual rights
B2B relationships
|
Reputation management
Commercial
Regulatory issues
|
Privacy & data protection
Evidence
|
Response |
|
Crisis Team
|
Key Actions
|
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage?
Cybersecurity has been a mainstay of quarterly board agendas for years.
The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.
UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.
The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
AmericasMexico
United States
|
EMEACzech Republic Belgium Finland France Germany Italy Poland Sweden Turkey United Kingdom |
Asia-PacificAustralia Mainland China Japan
|
World in Transition Our views on changing dynamics in energy, ESG, finance, globalization and US policy.
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
On March 3, 2021, the New York State Department of Financial Services ("NYDFS") announced that mortgage lender, Residential Mortgage Services, Inc. ("RMS") will pay a penalty of $1.5 million to the State to settle violations of NYDFS Cybersecurity Regulation, 23 NYCRR 500 ("Cybersecurity Regulation").1 Although, the NYDFS commenced its first enforcement action in July 2020 against insurer First American Title Insurance Company, this appears to represent the first penalty issued by the NYDFS under the Cybersecurity Regulation and the second reported enforcement action.
As we have set forth in our previous client alerts,2 NYDFS's Cybersecurity Regulation establishes numerous specific administrative and technical security requirements for covered entities to adopt and implement. The violations here stem from failures by RMS to disclose a 2019 data breach and to conduct required Cybersecurity Risk Assessments. Importantly, the violations were uncovered during a routine compliance examination between March and August 2020, providing notice to covered entities that the NYDFS will be proactive in its efforts to ensure compliance with the Cybersecurity Regulation. The NYDFS settlement continues a trend among regulators and lawmakers to focus on cybersecurity enforcement and establishing defined standards for compliance.
On March 30, 2020, NYDFS commenced a routine safety and soundness examination of RMS for the period between January 2017 and December 2019, which included an assessment of RMS’s compliance with the Cybersecurity Regulation. During the course of the examination, RMS disclosed that it had suffered a data breach 18 months earlier, in March 2019, and that it had not conducted an in-depth investigation of the incident nor disclosed the event’s occurrence to NYDFS or other state agencies.
The breach originated from a phishing email sent to an RMS employee. As a mortgage lender licensed in over 20 states, RMS collects sensitive personal information from customers applying for mortgage loans, including social security and bank account numbers. On March 5, 2019, an employee who collects a "substantial amount" of this data received a phishing email that appeared to come from a business partner. The employee followed a malicious link in the email to a website where she provided her email credentials. Although RMS maintained multi-factor authentication to protect company email accounts, the employee approved several remote login attempts to her email account, thereby granting the intruder access. The following day, on March 6, the employee notified RMS’s IT staff of the incident. The IT team traced the breach to an IP address in South Africa and blocked the unauthorized access to the email account. RMS did not investigate the matter further.
According to NYDFS, RMS failed to "(1) identify whether Employee’s mailbox contained private consumer data during the breach, (2) identify which consumers were impacted, and (3) apply the applicable state notice requirements triggered by the breach." Its failure to investigate the incident until prompted by NYDFS and its failure to disclose the breach for 18 months were both in violation of the Cybersecurity Regulation.
In its examination, NYDFS further discovered that RMS was in violation of the requirement under the Cybersecurity Regulation to maintain and conduct comprehensive cybersecurity risk assessments. Under the Cybersecurity Regulation, licensees must "identify and evaluate periodically vulnerability to cybersecurity risks and threats . . ." and design a cybersecurity program to mitigate those threats and risks. Finally, the NYDFS noted that RMS’s violations meant that it had also inaccurately certified its compliance with the Cybersecurity Regulation in its annual filing.
Following NYDFS's investigation, in fall 2020, RMS launched its own internal investigation into the data breach. RMS reviewed the sensitive personal information collected in the employee’s compromised emails, identified data that could have been accessed by the intruder, and subsequently notified the customers impacted by the breach along with the appropriate state agencies. Despite the initial delay in reporting the breach, NYDFS applauded RMS’s cooperation throughout its examination and investigation. The NYDFS did not disclose the number of customers whose data were impacted by the breach. Notably, however, the Massachusetts State Attorney General’s data breach report indicates 127 residents of Massachusetts were affected and had social security numbers, driver’s licenses, and credit numbers breached.
On March 3, 2021, NYDFS announced a settlement with RMS to resolve the violations of the Cybersecurity Regulation. The settlement included both a civil penalty and a number of other remedial provisions.
The $1.5 million penalty imposed by the NYDFS puts covered entities on notice that the NYDFS Superintendent’s enforcement actions will carry significant weight. While the lack of information regarding the number of impacted individuals here limits what we can predict concerning how the NYDFS might approach settlements and fines in other actions, the settlement nevertheless provides several useful takeaways.
The recent enforcement actions taken by NYDFS should remind covered entities to take the necessary steps to ensure active and continued compliance with Cybersecurity Regulations. Filing a certification cannot be an empty gesture, as the NYDFS has demonstrated it will conduct the appropriate due diligence to ensure covered entities’ annual certifications are accurate. And where violations are discovered, NYDFS will expect covered entities to rectify them and redress any outstanding harms to individuals.
1 NYDFS Press Release
2 NYS Department of Financial Services Cybersecurity Regulation Goes Live: Now What?, (Mar. 1, 2017); NYDFS Cybersecurity Regulations Compliance Guide: Applicability, Exemptions and Penalties, (Mar. 9, 2017); Sign and Submit by February 15, 2018: NYDFS Cybersecurity Certification Due Date Nears as Additional Compliance Requirements Close In (Jan. 24, 2018).
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2021 White & Case LLP