Cybersecurity & Risk Management

There is no one-size-fits-all approach to cybersecurity and risk management, which is why we are intimately familiar with the many federal and international legal frameworks and industry and technical standards. You can rely on our practical experience applying them to your risk management needs.

Cybersecurity risks are now enterprise risks, which must be understood and managed in the context of your enterprise as a whole and with your resources in mind. We offer practical solutions to build robust, risk-responsive frameworks to assist your organization in developing agile cyber risk management strategies that can adapt to keep pace with evolving threats. We provide a rigorous and holistic approach to cybersecurity risk assessment, grounded in practical, implementation-level advice to address sophisticated domestic and international data protection issues that require knowledge of your engineering capabilities, technology environments, and corporate culture.

Clients come to us for our global experience in cybersecurity risk management and data security program development and compliance, our flexible and knowledgeable team members, and our long-standing strong relationships with numerous leading global cybersecurity consultants. With all of these skills under the same practice umbrella, we are uniquely equipped to assist you—regardless of your company’s cyber maturity level—to build effective cyber legal infrastructure. We have seen it all, from startups breaking into highly regulated security environments to Fortune 100 companies seeking to advance their existing cyber programs to the next level.

Our clients stay with us and develop trusted relationships with our team because we focus on listening intently to their business needs and help them develop practical, risk-based solutions, all while understanding that cybersecurity does not exist in a vacuum. We combine our knowledge of cyber with strong business acumen to balance security with usability and enterprise architecture needs, always keeping in mind the need to responsibly stretch cyber spend. With this holistic approach, we help legal and security teams continue to strengthen internal relationships and build security as part of the business for the long term.

We apply our extensive technical knowledge of security engineering, evolving cybersecurity threats, and international legal standards and leverage our global relationships to craft effective, forward-looking cyber risk management strategies to support our clients’ business objectives. Let us help you further develop, implement, maintain, or enhance your cybersecurity risk management strategies.

Our cyber risk management, data security counseling, and program development experience includes structuring, implementing, and enhancing enterprise-wide privacy and cybersecurity policies and strategies as well as targeted, technical risk-based reviews of core areas of a company’s data security and risk management programs. We are prepared to help clients boost compliance with relevant legal, industry, and technical standards across the globe.

We assist some of the largest global brands with implementing global data protection compliance programs and analyzing data privacy laws and regulations around the world. Alston & Bird’s Global Privacy and Security Network formalizes our relationships with leading privacy counsel in jurisdictions around the world, providing clients with access to true specialists in each country.

Cyber Risk Management

Cyber Risk Assessment. To effectively manage cybersecurity risk, organizations need to know both where their cybersecurity program currently stands and where they think it needs to be. To understand what controls and safeguards are necessary to mitigate cybersecurity threats, and implement effective detection methods for those areas, the starting place is often a cybersecurity risk assessment. Our team performs privileged cybersecurity risk and legal assessments of a company’s cybersecurity program, often working with third-party security consultants that specialize in this area to take advantage of their technical expertise and sophisticated tools. These assessments typically consist of two phases: (1) onsite interviews with subject-matter experts to understand how they view the organization’s practices and to identify relevant documentation for our review; and (2) presentation of our findings in a written report.
Internet of Things and Technology Cybersecurity Risk Review. With the increasing attention to security vulnerabilities in products and services, and connected devices in particular, companies are increasingly expected to be actively, and even proactively, engaged with vulnerability management and incorporating sound security practices into the design of new products and services. We assist clients in cybersecurity risk reviews of new products and technologies early in the development process to help ensure the security practices are consistent with regulator expectations and industry standards. We also conduct reviews of security-related technologies to identify whether specific uses may raise any federal or state statutory or constitutional concerns, such as implicating the federal Computer Fraud and Abuse Act or state and federal Wiretap Acts.
Advice to Public Company Boards and the C-Suite. We provide cyber-risk consultation services to senior management and directors to highlight the cyber-related risks faced by the company as well as the directors individually. Our services assist in providing board-level and senior management information security and cyber-risk presentations and training regarding their pre-breach and post-incident responsibilities, emerging trends in cybersecurity corporate governance, and strategies to minimize cyber risk exposure. We educate boards on the importance of the information life cycle and help companies achieve a clear understanding of the data they create, where it is located, how it is used, and how it is retained. We also provide advice to senior officers on day-to-day management of cybersecurity risks and preparation of board and officer materials so that the board and its advisors properly address cybersecurity risks with sound and balanced documentation. We routinely calibrate these services across the spectrum of publicly held companies, from relatively small and recently listed companies to some of the largest financial institutions and industrial concerns in the world.
SEC Disclosures Review. Many public companies are well aware of the SEC’s guidance on cyber-risk disclosures and the SEC’s continued interest in reviewing such disclosures in the wake of a significant cyber event. Our team has assisted many public company clients in reviewing their cyber-related public filings to ensure that they are appropriate and sufficient, including by comparison to the disclosures of industry peers based on their industry presence and market capitalization.
Cyber Insurance Review. As a key part of their incident response plans and procedures, companies should carefully consider whether they have adequate insurance coverage for cybersecurity risks, including coverage for forensic investigation, consumer notification, credit monitoring, call center operation, public relations, cyber extortion, regulatory investigations, payment card brand assessments, and other third-party claims. Our team has assisted many clients in assessing their current level of cyber insurance coverage, as well as identifying exclusions, conditions, and limitations that they should avoid.

Cybersecurity Program Development and Counseling

Written Information Security Programs (WISP). Domestic and international legal regimes provide a vast array of rapidly evolving data security and data breach notification compliance obligations. Whether our clients are taking their first steps toward implementing a WISP or already have extensive documentation in place as part of a mature information security program, we partner with our clients to build out or update security policies and procedures based on their unique compliance obligations, whether at the state, federal, or international level. We regularly apply common industry frameworks, such as ISO, NIST, and the CIS Controls, to help our clients benchmark their programs and demonstrate their commitment to adopting cybersecurity best practices. As part of our practical approach, we get to know our clients’ business needs and help ensure that their WISP is tailored to their day-to-day operations and corporate culture.
Risk-Based Reviews of Information Security Programs. Companies with established cybersecurity programs should consider evaluating their program against the rapidly changing domestic and international legal regulatory environment, whether those changes are based on new regulatory guidance, enforcement actions, or regulations. We work with an international network of firms to help our clients first identify which laws apply to their business and then stay on top of important changes. We assist clients in these evaluations with a defined methodology based on applicable regulatory standards, recommended frameworks, industry best practices, and the company’s cybersecurity risk profile. Our typical services in this area include identifying and reviewing compliance obligations, as well as conducting reviews of specific areas such as risk assess¬ment practices and client security questionnaires. Using the results of these assessments, we identify legal and strategic risks arising from gaps and recommend strategies for mitigating them in a prioritized, risk-informed manner. We protect this review to the maximum extent possible with the attorney-client privilege.
Information Sharing and Cyber-Threat Intelligence. Cyber-threat intelligence sharing is a critical tool in managing risk and should be considered a core element in a company’s cybersecurity program. With the passage of the Cybersecurity Information Sharing Act of 2015, companies, especially those designated as critical infrastructure, need to keep abreast of cybersecurity developments and initiatives by the federal government, regulators, and other industry stakeholders. Companies within certain industries are expected to participate in information-sharing groups, whether ISACs, ISAOs, or less-formal platforms. Our multidisciplinary team of attorneys regularly advises clients on scalable solutions to automate the cyber-threat information process and position themselves to identify and prevent cyber-attacks. Services may vary from cybersecurity policy development to advising on legal reporting requirements.
Third-Party Vendor Security Review. Ask any CISO where their biggest data security concerns lie, and third-party vendors will be at or near the top of their list. Our Cybersecurity & Risk Management Team understands the increasing cyber-threat posed by sharing information with external parties and partners to protect the company’s most valuable assets, regardless of where they are stored. As service providers and other vendors have been recognized in recent years as an effective attack vector for bad actors, managing cybersecurity risks with these third parties has become an essential exercise (and often, a legal requirement). Our internationally recognized lawyers regularly advise on the most pressing legal and regulatory issues, including cyber risk assessment and management, vendor selection and procurement, due diligence, contracting, and ongoing security oversight based on evolving industry-specific requirements. We also work extensively with clients to build or improve their third-party cyber risk management programs and deliver fixed- and alternative-fee arrangements for program startup and continuation.
Vulnerability Disclosure Program. Many companies are beginning to understand that they should not wait for a data breach to contend with regulatory and litigation exposure from cyber-risk. Security vulnerabilities alone can bring them under scrutiny for their cybersecurity practices. Prompted by the potential exposure to cybersecurity vulnerabilities—or because of regulatory expectations, depending on the industry—many companies are considering, or adopting, vulnerability disclosure programs (or “bug bounty” programs) to encourage individuals who discover vulnerabilities in products and services to bring them to the attention of the company before going public. To that end, we help companies evaluate, design, and implement vulnerability disclosure programs in line with regulator ex¬pectations and based on the company’s cyber-risk profile.

Data Security Compliance

Data Life Cycle Services. Understanding what data you have, what your crown jewels are, and where that data resides is the first step in understanding how that data needs to be protected. Our information life cycle services are designed to get your organization on top of its data use practices and then regularly review those practices to minimize ongoing exposure. These services generally include data inventorying and information-transfer analysis, IT environment-mapping exercises, privacy compliance analysis, and information policy and privacy statement review and development.
Legislative and Policy Advice. Drawing on our comprehensive experience in data security, privacy, payments issues, and regulatory investigations, Alston & Bird advises on the specific legal and regulatory data security compliance concerns your company faces. We interpret the application of various data breach and privacy-related statutes and regulations in the circumstances of your individual company and provide practical compliance advice. We constantly monitor this space for changes and updates to the law and advise on how those changes affect your company. Our attorneys stay informed of the types of security practices regulators deem to be reasonable or adequate (or unreasonable or inadequate) and can provide your company with a regularly updated, detailed checklist customized to your industry and company, summarizing both recommended security practices and inadequate security measures.

Contacts

Kimberly Kiefer Peretti

Partner

Washington, D.C.

Phone: +1 202 239 3720

Email: kimberly.peretti@alston.com

Katherine Doty Hanniford

Partner

Washington, D.C.

Phone: +1 202 239 3725

Email: kate.hanniford@alston.com