A patchwork, not one statute
There is no single federal cybersecurity law covering all businesses. Sector rules apply instead, such as HIPAA for health information, the Gramm-Leach-Bliley Act for financial institutions, and requirements for defense contractors and other federal suppliers. Every state has a data breach notification law, and many also require reasonable security safeguards for personal information, as New York does under the SHIELD Act. New York's Department of Financial Services imposes a detailed cybersecurity regulation on the banks, insurers, and other entities it licenses, with requirements that were expanded and phased in over recent years. Public companies face SEC rules requiring disclosure of material cybersecurity incidents and annual discussion of risk management and governance, though the SEC has sought comment on revising its disclosure rules, so the current requirements should be confirmed. The FTC and state attorneys general also treat weak security as an unfair or deceptive practice in many cases.
When an incident happens
Incident response is where cybersecurity law becomes urgent. Notification obligations to regulators, individuals, business partners, and sometimes law enforcement may begin to run before the investigation is complete, and some regulators expect notice very quickly. Isolate affected systems from the network without wiping or powering them down where possible, and preserve the logs and images investigators will need. Engaging a forensic firm through counsel can help protect privilege over the investigation, though courts look at whether the work was truly done to support legal advice. Ransom payments raise their own concerns, including sanctions rules that may bar payment to certain groups. Insurers usually need prompt notice and may have panel vendors you are expected to use.
Building a program before the next incident
Our work outside a crisis usually starts with a map of what data the business holds, where it sits, and which laws and contracts govern it. We review written security policies, incident response plans, and vendor contracts, since many incidents begin with a third party. We look at board and management reporting, which regulators increasingly expect to see documented. Tabletop exercises with legal, technical, and communications staff often expose gaps that a policy review misses. We coordinate with your security team or outside technical advisors and keep our role focused on the legal obligations and the records showing they were met.
