Cybersecurity Insights

Keep up with the latest cybersecurity trends and observations by reading our Privacy + Data Security team’s news coverage, including:

Client Alerts

• An Unprecedented Cross-Border Data Regulatory Regime Version 3.0: Department of Justice Issues Final Rule Regulating Bulk Sensitive Data Transfers (07 Jan 2025)
• EU Cyber Resilience Act Raises the Cybersecurity Bar for Digital Products (21 Nov 2024)
• What to Expect from the SEC During a Second Trump Administration? (14 Nov 2024)
• DORA Decoded: Understanding Cybersecurity for the Financial Services Sector (25 Oct 2024)
• The SEC’s Risk Disclosure and Controls Claims Against SolarWinds Fall to the Cutting Room Floor (23 Jul 2024)

• Proposed Regulation on Controlled Unclassified Information Standardizes Process for CUI Identification and Handling Across Federal Agencies (23 Jan 2025)
• Biden’s Final Cybersecurity Order Proposes Significant Changes, All to Be Implemented by the Incoming Administration (21 Jan 2025)
• Cyber Risk of State Auditors Demanding Full SSNs in Assessing Unemployment Insurance Claims (03 July 2024)

• U.S. SEC Issues Updated Guidance on Cybersecurity Disclosure Under Item 1.05 of Form 8-K (25 June 2024)
• The SEC’s Controls-Based Approach to Cybersecurity Enforcement Continues, with an Accounting Twist (25 June 2024)
• A $10 Million Civil Penalty for Delayed Reporting of a De Minimis Cyber Incident: The SEC’s Cyber Enforcement Marches on (28 May 2024)
• EU Cyber Resilience Act Raises the Cybersecurity Bar for Digital Products (23 May 2024)
• CISA’s Very Broad Proposed Rule for “Critical Infrastructure” Entities to Report Cyber Incidents (02 April 2024)
• MoFo’s State + Local Government Enforcement Newsletter (08 Jan 2024)

• The Actual and Possible Impact of New York State Department of Financial Services Amendments to Its Cybersecurity Regulation (07 Dec 2023)
• Keeping Pace with Changes to the CPPA’s Draft Regulations on Cybersecurity Audits, Risk Assessments, and Automated Decision-Making Technology (05 Dec 2023)
• A New Frontier for SEC Cybersecurity Enforcement? The SEC Charges SolarWinds and its CISO with Securities Fraud (03 Nov 2023)
• Litigation Readiness: Seven Things to Keep in Mind (25 Oct 2023)
• Six Considerations to Preserve Privilege (10 Oct 2023)
• SEC Adopts Cybersecurity Disclosure Rules for Public Companies (28 Jul 2023)
• Comments to Proposed Changes to the Health Breach Notification Rule Due August 8, 2023 (07 Jul 2023)
• SEC Delays Finalized Cyber Rules Until October 2023 (20 Jun 2023)
• NIST Releases Revised Cybersecurity Controls and Requirements for Protection of Controlled Unclassified Information Resident in Contractor Information Technology Systems (15 May 2023)
• Federal Government Provides Further Guidance and Draft Attestation Form for Software It Acquires (02 May 2023)
• The SEC Expands Focus on Cybersecurity Risk to Include Registered Advisers, Broker‑Dealers, and other Market Participants (14 Apr 2023)
• No Injury, No Data Breach Claims? Recent Trends in Evaluating Standing in Data Breach Class Actions (05 Apr 2023)
• The Biden Administration’s National Cybersecurity Strategy Calls for a Shift Toward More Cybersecurity Regulation (06 Mar 2023)

• The Benefits and Risks of Notifying Law Enforcement (09 Feb 2023)
• What Should Boards Think About After a Breach? (27 Jan 2023)

• Morrison Foerster’s Economy & Markets Research Report (13 Dec 2022)
• Privacy + Data Security Predictions for 2023 (07 Dec 2022)
• Communicating with the SEC When Your Organization Suffers a Cybersecurity Incident (02 Nov 2022)
• Cybersecurity Expectations Intensify for Medical Device Cos. (25 Oct 2022)
• Staying Ahead of Cryptocurrency Hacks and Legal Risks (12 Sep 2022)
• NYDFS Considering Significant Updates to Its Cybersecurity Rule (30 Aug 2022)
• China PIPL: Data Export Regime Starts to Take Form (19 Jul 2022)
• Ransomware and the Healthcare Industry (01 Jun 2022)
• NIS 2: A Sequel Worth Watching (31 May 2022)
• Justice Department Revises Cyber Crime Charging Policy to Shield Good-Faith Security Research (25 May 2022)
• Data Breach Litigation Review and Update (22 Apr 2022)
• U.S. Congress Passes Cyber Incident and Ransom Payment Reporting Requirement (March 11, 2022)
• SEC Proposes Cybersecurity Disclosure Rules for Public Companies (11 Mar 2022)
• Private Sector Directed to Be on Alert for Potential Russian Cyber Attacks (28 Feb 2022)
• Addressing Ransomware in Healthcare (19 Feb 2022)
• SEC Proposed Rule Delineates Cybersecurity Policy Requirements for Investment Advisers and Private Funds (15 Feb 2022)
• A MoFo Privacy Minute Q&A: How to Defend, Detect, Prevent, and Respond to Credential Stuffing (02 Feb 2022)
• Understanding Your Exposure When Buying, Selling, or Investing Into Data Businesses (28 Jan 2022)
• Providers of IoT Devices Have 2.5 Years to Implement Stricter Security and Privacy Requirements to Keep Access to the EU Market (26 Jan 2022)
• Top Cybersecurity Considerations for Government Contractors in 2022 (11 Jan 2022)
• Federal Banking Agencies Issue Long-Awaited Computer Security Incident Notice Rules (22 Nov 2021)
• U.S. Government Takes Increasingly Aggressive Actions Targeting Ransomware (11 Nov 2021)
• Department of Defense Pivots on CMMC (09 Nov 2021)
• DOJ Cyber-Fraud Initiative Highlights Potential Civil Liability for Failing to Meet Federal Cybersecurity Requirements (12 Oct 2021)
• OFAC Issues New Ransomware Guidance and First Sanctions Designation Against Virtual Currency Exchange (22 Sep 2021)
• The SEC Gets Tough on Cybersecurity Disclosure Controls (13 Sep 2021)

News

• If You Prepare, a Data Security Incident Will Not Cause an Existential Crisis (09 Jan 2024)
• Boards Must Be Wise to the Risks of Text Messaging (16 Oct 2023)
• U.S. Securities and Exchange Commission Adopts Cybersecurity Disclosure Rules for Public Companies
• Expert Q&A on Aligning Cybersecurity and ESG Strategies (26 Sep 2023)
• Here’s what to know about the SEC’s new cybersecurity disclosure requirements (21 Sep 2023)
• How to Ensure Effective Threat Intelligence (07 Sep 2023)
• Genesis Market Seizure a Warning That Cybercrime is No Longer Anonymous (18 Apr 2023)
• Cyberinsurance Backstop: Can the Industry Survive Without One? (18 Apr 2023)
• Cybersecurity Predictions for 2023 (06 Jan 2023)
• As Cybersecurity Threats Increase, Lawyers Have Practical Advice for Clients (27 Dec 2022)
• New Scrutiny for Apps and Data Brokers (13 Oct 2022)
• Cybersecurity Is a Male-Dominated Field, but Cybersecurity Law Doesn’t Have to Be (18 Jul 2022)
• Feds Aim For More Insight On Hacks With Maze of Policies (12 Aug 2022)
• CAC Issues Measures on Data Export Security Assessments (01 Aug 2022)
• “It’s Coming”: President Biden Warns of “Evolving” Russian Cyber Threat to U.S. (21 Mar 2022)
• The Cybersecurity 202 (11 Mar 2022)
• Gensler Says SEC to Consider New Rules for Cybersecurity, Data Privacy Disclosures (25 Jan 2022)
• Cybersecurity & Privacy Policy to Watch in 2022 (05 Jan 2022)
• Hong Kong Listings Subject to Cyber-security Review Under CAC Draft Regulations, Lawyers Say (23 Nov 2021)
• Known Cyber Threats to Be Addressed Listed by Security Agency (04 Nov 2021)
• How to Respond to Government’s Renewed Emphasis on Cybersecurity (15 Oct 2021)
• DOJ Cybersecurity Crackdown May Inspire Whistleblowers (08 Oct 2021)
• Crypto Exchange Blacklisting To Test US Sanctions’ Teeth (25 Sep 2021)
• S. Aims to Thwart Ransomware Attacks by Cracking Down on Crypto Payments(17 Sept 2021)
• The Latest Cybersecurity Threat: Pay Us or We Release the Data(07 Sep 2021)
• Why Making Companies Disclose Ransomware Payouts May Be a Good Idea(22 Jul 2021)
• 2 State Cybersecurity, Data Privacy Laws Enacted(13 Jul 2021)
• An Inside Look at Law Enforcement Response to Cyberattacks(22 Jun 2021)
• Cyberattacks, Privacy Legislation Shape M&A Dealmaking Process(14 Jun 2021)
• Lawmakers Urge FTC to Enforce Health Breach Notification Rule(08 Mar 2021)
• Cybersecurity and Privacy Policy to Watch in 2021 (03 Jan 2021)

Events

• Navigating the SEC’s Latest Cybersecurity Disclosure Rules for Public Companies (07 Aug, 2023)
• Cybersecurity Through an ESG Lens: Aligning Cyber and ESG Strategies (25 Oct 2022)
• The Oft-Overlooked Cybersecurity Requirements Of The New 2023 State Privacy Laws (October 13, 2022)
• China’s PIPL One Year On: What You Need to Know Now (September 27 – 29)
• Take Notice: Exploring the Impacts of new U.S. State Laws on Companies' Privacy Disclosures (Expires February 23, 2023)
• Anatomy of a Ransomware Attack (Expires February 23, 2023)
• At Your Service: How the New CA, CO, and VA Privacy Laws Impact Service Providers and the Businesses That Engage Them (Expires February 23, 2023)
• CCPA Litigation and Enforcement: Best Practices for Your Company (Expires September 22, 2022)
• Wall Street Journal Webinar: Cybersecurity Issues in Contact Tracing
• Fight Back: How to Stop Cyber Criminals During the Pandemic

Video + Audio

• Preparing for the SEC Cyber Security Disclosure Rules (08 Dec 2023)
• The EU Cybersecurity Framework (24 Oct 2023)
• Why Cybersecurity Is Critical to Your ESG Performance (16 Oct 2023)
• Cybersecurity Month: Privacy Tips You Can Use (27 Oct 2022)
• Ransomware Incident Response: Avoiding Action Bias (23 Feb 2022)
• Regulation Around the World (01 Dec 2021)
• Ransomware Fireside Chat Series (12 Oct 2021)
• Board Table Top Exercise: A Realistic Ransom-Scenario-Driven Discussion (08 Jul 2021)

Podcasts

• When Your Life Sciences Are on the Line Podcast: Cybersecurity (16 Oct 2024)

• MoFo Perspectives: The Cyberstalking Resource Initiative (31 Oct 2022)
• Above Board: Before, During and After a Breach: The Questions Boards Should Ask (07 Oct 2022)
• MoFo Competition Podcast: The ESG Movement and Its Impact on Antitrust Compliance (07 Jul 2022)
• In House Warrior: Two Lions of the DOJ (23 Jun 2022)
• Above Board: Proposed Cybersecurity Disclosure and Reporting Requirements for U.S. Public Companies and Critical Infrastructure Entities (01 Apr 2022)
• Ransomware and the Sale of the Denver Broncos (29 Dec 2021)
• Above Board Podcast: 2021 Cyber Events Shaping the Horizon (18 Oct 2021)
• Cyberattacks in the Time of Remote Work (07 Apr 2021)

Blog Post

• Biden’s Final Cybersecurity Order Proposes Significant Changes, All to Be Implemented by the Incoming Administration (21 Jan 2025)