The Second Amendment to the New York Department of Financial Services’ (“NYDFS”) Cybersecurity Requirements for Financial Services Companies (the “NYDFS Requirements”) is expected to be published in final form in the next two weeks. The Second Amendment will follow updated
Inside Cybersecurity & Privacy Law
Exploring the evolution of cybersecurity and privacy law
Latest from Inside Cybersecurity & Privacy Law - Page 2
EU Cyber Resilience Act Moves Closer to Adoption
On 13 September 2023, negotiations began between European institutions to adopt the text of the EU Cyber Resilience Act (the “CRA”). If adopted, the CRA will impose a set of software security, cybersecurity, and vulnerability management requirements on products with…
CFPB Initiates Fair Credit Reporting Act Rulemaking Focusing on Data Brokers
On September 25, 2023, the Consumer Financial Protection Bureau (“CFPB”) began its most substantial Fair Credit Reporting Act (“FCRA”) rulemaking yet with an outline of proposed changes to Regulation V, which implements FCRA, ahead of the Bureau’s Small Business Advisory Review…
Round-Up: Proscriptive ICTS Supply Chain Regulation as a Means of Addressing Cyber Risk
Cybersecurity Awareness Month is a good time to highlight one trend in federal efforts to address cyber risk: proscriptive regulation of the information and communications technology and services (“ICTS”) supply chain.
Supply chain risk management is a broad field encompassing,…
Software Security: Recent Policy Actions Highlight Importance of Mitigating Legal Risks
Recent high-profile cyber incidents involving exploitation of software vulnerabilities—such as the SolarWinds and MOVEit incidents—have increased scrutiny of the security of the software upon which corporate and government customers rely. Though phishing and social engineering continue to be leading causes…
China Proposes Easing of Cross-Border Data Controls
On the eve of the “Golden Week” in China, the Cyberspace Administration of China (CAC) published the draft Provisions on Regulating and Promoting Cross-Border Data Transfers (the “Draft Provisions”) on 28 September 2023.1
The Draft Provisions provide a welcome rollback…
FAR Changes Proposed to Standardize Important Cybersecurity Requirements and to Impose New Cyber Threat, Incident Reporting and Information Sharing Rules
Last week, the government announced two sets of proposed revisions to the Federal Acquisition Regulation (FAR) to improve the cybersecurity of the government’s information systems. Both sets of revisions relate to President Biden’s May 2021 Executive Order 14028 on Improving…
Artificial Intelligence and Cybersecurity: Key Topics at the 78th United Nations General Assembly
Recently, world leaders and key stakeholders gathered for the 78th session of the United Nations General Assembly (“UNGA”) to discuss global challenges with the goal of furthering peace, security, and sustainable development. A key topic of discussion was the “digital…
UK Government Announces New UK-US Data Bridge
Today, the UK Department for Science, Innovation and Technology announced further details on the new transatlantic data flow mechanism for UK-to-US personal data transfers. In particular, the UK Secretary of State for Science, Innovation, and Technology today laid new adequacy…
India Passes Privacy Law
India—the fifth largest economy in the world—just passed a comprehensive privacy law. On August 11, 2023, the Digital Personal Data Protection Act, 2023 (the “DPDP”) was approved by the president of India, adding India to the list of global powers…