Who may come asking
Depending on the company and the data, inquiries can come from state attorneys general, the Federal Trade Commission, New York's Department of Financial Services for companies it supervises, the federal health department's civil rights office for health information, or the Securities and Exchange Commission about a public company's disclosures. Several may act at once, and attorneys general from different states sometimes coordinate. Each has its own tools, from informal requests to compulsory demands, and its own view of what reasonable security means. An informal letter still deserves a careful answer, because it often decides whether the matter escalates.
What the questions focus on
Regulators usually want to know what the company knew about its risks before the incident and what it did about them. Prior assessments, audit findings, unpatched vulnerabilities, gaps in multi-factor authentication, and internal emails raising concerns are common subjects. They also ask whether the company's public statements about security matched its actual practices, and whether notice was given on time and accurately. Cybersecurity defense in this setting is largely a matter of presenting an accurate, documented account of reasonable decisions, and correcting mistakes in the regulator's understanding early. Answers to an agency must be accurate and complete, and a knowingly misleading one can create a problem larger than the original incident.
Shaping the response
We begin by assembling the documents the agency is likely to request and reviewing them before anything is produced, so problems surface internally first. Scope and timing of productions are negotiated where possible. Written narratives and presentations to agency staff often matter as much as the documents themselves. If remediation is under way, showing it with evidence helps. Resolutions, when they come, can include payments and multi-year compliance obligations, so we keep the likely terms in view from the first exchange rather than only at the end. Where several agencies are involved, we coordinate so that the account given to each one is consistent.
