Where cybersecurity duties come from
Cyber compliance obligations arrive from several directions at once. In New York, the Department of Financial Services has a detailed cybersecurity regulation for the banks, insurers, and other companies it licenses, and the SHIELD Act requires businesses holding New York residents' private information to maintain reasonable safeguards. Public companies face SEC disclosure rules on material cybersecurity incidents and risk management, defense contractors face federal contract requirements, and health care organizations answer to HIPAA's security standards. Customer contracts and cyber insurance policies frequently add conditions of their own, and those can be the most demanding of all.
Evidence that a program exists
Regulators and insurers tend to ask for proof, not policies. Keep a current risk assessment, an asset inventory, records of access reviews and multi-factor authentication coverage, vendor security reviews, and an incident response plan that has actually been tested. Document who approved security decisions and how management and the board were briefed. Make sure certifications and questionnaire answers match reality, because a statement that overstates controls can create liability of its own, separate from any breach. If a gap is known, record the plan for closing it and who owns that plan.
Prioritizing a review
Our first task is identifying which regimes actually apply to your business and which contractual promises you have already made. We then look at the controls most often tested after an incident, such as access management, backups, and logging, and at whether your incident response plan accounts for regulatory notice deadlines, some of which are measured in hours or days. Where a security assessment is needed, we discuss having counsel engage the assessor so that legal advice and technical findings are organized with privilege in mind, though whether privilege holds depends on how the work is structured and used. If an incident is already under way, the priorities shift to containment, preservation, and notice decisions, and the broader review waits.
