Corporate Cyber Security & Data Privacy
Cyber & Data Privacy Desk
Fourteen named sub-domains spanning the obligation itself — incident response, breach notification, board oversight — and the commercial and regulatory exposure that follows it.
Incident Response & Breach Notification
The WISP and IRP obligations, and the notification clock that starts running the moment an incident is confirmed.
Materiality & Notification Triggering
The statutory thresholds — data-element definitions, encryption safe harbors, risk-of-harm tests — that decide whether disclosure is required at all.
Board Oversight & Fiduciary Duty
What Caremark actually requires of directors on cyber-risk oversight, and where "utter failure" gets tested.
SEC Cyber-Disclosure & Internal Controls
The Item 1.05 Form 8-K clock, the four-business-day window, and the narrow national-security delay exception.
Vendor & Subprocessor Contracting
The flow-down clauses, DPAs, and audit rights that push your security obligations down the supply chain.
Certification & Attestation
FedRAMP, CMMC, and SOC 2 — the compliance artifacts and third-party assessments each one actually requires.
Cyber-Insurance Coverage Doctrine
Trigger sufficiency, notice timing, and the sequence a claim has to clear before a policy responds.
Sectoral Security Mandates
HIPAA, GLBA, and NYDFS Part 500 — the written information security program each regulator separately demands.
Privilege & Forensic Engagement
Retaining the forensic firm through counsel, so the investigation report has the best chance of staying privileged.
Litigation Hold & Evidence Preservation
When the duty to preserve starts, and suspending routine deletion before a regulator or plaintiff asks for the data.
FTC & State Attorney General Enforcement
Investigations under unfair and deceptive practices law — civil investigative demands, consent orders, and penalties.
Private Litigation & Whistleblower Exposure
Class actions, securities claims, and whistleblower suits that follow a breach or a security certification.
Cross-Border Data Protection
Whether a data transfer out of the EU, China, or another regime is lawful, and the mechanism that makes it so.
Sanctions & Export-Control Liability
Screening a ransom payment against sanctions lists, and export-control limits on who may touch breach data.