Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws

Summary. Almost every American business is under a legal duty to secure the data it holds, but no single statute says so; the duty is assembled from the FTC Act, sector rules, securities disclosure law, state statutes, and the common law. This article maps that duty: the FTC's unfairness and deception authority as tested in Wyndham and LabMD, the amended GLBA Safeguards Rule and its thirty-day FTC notice requirement, NYDFS Part 500 as amended in November 2023, and the SEC's 2023 incident and governance disclosure rules together with the SolarWinds litigation. It then covers the state security statutes in Massachusetts, New York, and California, the sector regimes for health data, telecommunications, defense contractors, insurers, and critical infrastructure, and the way regulators and courts actually measure "reasonable security" against frameworks such as NIST CSF 2.0 and the CIS Controls. It explains the board's oversight duty under Caremark as applied to cyber risk in the Marriott and SolarWinds cases, and the sanctions risk in paying a ransom. Two worked examples follow, a regional auto dealer group under the Safeguards Rule and a public SaaS company deciding whether a ransomware attack is material, along with common mistakes, an FAQ, and practical takeaways for companies, boards, and the lawyers on both sides.

When attackers stole records on about 2.5 million customers of Drizly, the alcohol delivery platform, the Federal Trade Commission did not stop at ordering the company to fix its security. Its January 2023 order also bound Drizly's chief executive, James Cory Rellas, personally: for ten years, any company he runs or controls with authority over information security must maintain a written security program. The attacker got in through the company's GitHub repositories, where credentials to its cloud database had been left in the code. The consequence followed a person.

That order is a fair summary of where American cybersecurity regulation has gone in the last decade. The old question was whether a company had "some security." The new questions are whether it can produce a written program built on a written risk assessment, who is accountable by name, whether the board heard about it in writing, whether multi-factor authentication covers every door, and whether the company told the right regulator within a clock that is now measured in hours or business days.

The short answer

There is no general federal cybersecurity statute for private businesses. The duty to secure data comes from five overlapping sources, and most companies are subject to at least two of them:

1. The FTC Act. Section 5 prohibits "unfair or deceptive acts or practices." 15 U.S.C. § 45(a). For twenty years the FTC has treated unreasonable data security as unfair, and false or exaggerated security promises as deceptive. The Third Circuit confirmed that authority in FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015). This applies to almost every business that is not a bank, a common carrier, or a nonprofit.
2. Sector rules. The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule for nonbank financial institutions, which is a far larger group than the name suggests; the HIPAA Security Rule for health plans, providers, and their vendors; New York's Part 500 for banks, insurers, and other firms licensed by the New York Department of Financial Services (NYDFS); FCC rules for telecommunications carriers; DFARS and CMMC for defense contractors; NERC standards for the power grid; TSA directives for pipelines and railroads.
3. Securities disclosure law. Since December 2023, public companies must report material cybersecurity incidents on Form 8-K within four business days of deciding they are material, and must describe their cyber risk management and governance every year in the Form 10-K. These rules regulate what a company says, and how it governs, more than what it does, but disclosure has a way of becoming substance.
4. State law. Massachusetts requires a written information security program for anyone holding a resident's personal information. New York's SHIELD Act and California's Civil Code require "reasonable" safeguards, and California backs the requirement with a private right of action and statutory damages after a breach. More than twenty states have adopted the NAIC Insurance Data Security Model Law for insurers and other insurance licensees.
5. Common law and contract. Negligence claims after a breach, contract claims by business partners, and payment card network rules (PCI DSS) that are not law at all but are enforced through merchant agreements.

Underneath the different vocabularies, the regimes converge on the same core: a written program based on a written risk assessment, a named accountable person, access controls and multi-factor authentication (MFA), encryption, logging and monitoring, testing, vendor oversight, training, an incident response plan, and reporting to the board. The differences that matter are in scope, in how prescriptive the controls are, in the reporting clocks, and in who can sue or fine you.

This article explains each regime, the cases that define it, and how the pieces fit together. It is about the duty to secure data. The duty to notify people after a breach is a related but separate body of law, covered in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation. For the program-building steps, see the companion guide, Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide.

The legal framework at a glance

The table below is the map. Each row is explained in the sections that follow.

The FTC's general authority: unfairness, deception, Wyndham, and LabMD

How a consumer protection statute became a security statute

Section 5 of the FTC Act says nothing about computers. It declares "unfair or deceptive acts or practices in or affecting commerce" unlawful and empowers the Commission to stop them. 15 U.S.C. § 45(a). The FTC has built its data security program on both halves of that phrase.

Deception is the easier theory. A company that tells customers it uses "industry-standard encryption" or "bank-level security," and does not, has made a material misrepresentation likely to mislead a reasonable consumer, which is the test the FTC set out in its 1983 Policy Statement on Deception. Privacy policies, security pages, app store descriptions, sales decks, and security questionnaires answered for business customers are all representations. Many FTC security cases are pleaded first as deception cases for exactly this reason.

Unfairness is the theory that lets the FTC reach companies that never said a word about security. Congress codified the test in 1994: the Commission may not declare a practice unfair unless it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition." 15 U.S.C. § 45(n). Public policy may be considered as evidence, but it cannot be the primary basis.

Applied to security, the argument runs like this. Consumers hand over personal information they cannot protect themselves. A company that stores it carelessly makes theft and fraud likely. The consumer cannot avoid the injury, because she cannot see the company's network or audit its patching. And the cost of reasonable precautions is modest compared with the harm. The one conceptual hurdle, that criminals rather than the company inflict the injury, was cleared in cases outside the security context. In FTC v. Neovi, Inc., 604 F.3d 1150 (9th Cir. 2010), the Ninth Circuit held a check-creation service liable for unfairness because its lax verification let fraudsters draw checks on other people's accounts. In FTC v. Accusearch Inc., 570 F.3d 1187 (10th Cir. 2009), the Tenth Circuit held a data broker liable for selling telephone records that its researchers obtained by pretexting. Facilitating a third party's harm can be an unfair practice in its own right.

FTC v. Wyndham: the FTC may police security, and companies have notice

The test case was the hotel chain. In 2008 and 2009, hackers got into Wyndham's network three times, and the FTC alleged that the intrusions compromised more than 619,000 payment card accounts and led to more than $10.6 million in fraud losses. The complaint listed the failures that would become the FTC's standard catalog: payment card data stored in clear text, default and easily guessed passwords, no firewalls between the hotels' systems and the corporate network, unpatched operating systems, unrestricted vendor access, and no reasonable way to detect intrusions or respond to them.

Wyndham moved to dismiss, arguing that the FTC had no authority over data security at all. The district court disagreed in FTC v. Wyndham Worldwide Corp., 10 F. Supp. 3d 602 (D.N.J. 2014), and the Third Circuit affirmed on interlocutory appeal in Wyndham, 799 F.3d 236. Three holdings matter.

• A company victimized by hackers can still act unfairly. The court rejected the argument that conduct cannot be "unfair" when the company is itself a victim of crime. A business that leaves the door unlocked shares responsibility for the burglary's foreseeable consequences.
• Later sector statutes did not displace the FTC. Congress's enactment of the Fair Credit Reporting Act, the GLBA, and COPPA, each with its own security provisions, did not imply that the FTC lacked general authority elsewhere.
• Fair notice was satisfied. Because the FTC had not issued a formal interpretation entitled to deference, the question was whether Wyndham had fair notice that its conduct could fall within the statute, not whether it knew exactly what the FTC would demand. The statute's cost-benefit language, together with the FTC's published guidance and its prior complaints and consent orders, gave enough warning that leaving card data unencrypted and the network open could be unfair.

Wyndham settled in December 2015 with a twenty-year order requiring a comprehensive security program and annual assessments of its payment card environment against PCI DSS.

LabMD: the order must tell the company what to do

The FTC's other landmark security case went the other way, and its lesson is about remedy rather than liability. LabMD was a small cancer-screening laboratory. The FTC alleged that a billing manager had installed LimeWire, a peer-to-peer file-sharing program, on a work computer, exposing a file with personal and health information for about 9,300 patients. LabMD fought, lost before the Commission, and petitioned for review. (An earlier attempt to challenge the proceeding before any final order failed for want of final agency action. LabMD, Inc. v. FTC, 776 F.3d 1275 (11th Cir. 2015).)

In LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018), the Eleventh Circuit assumed, without deciding, that a negligent failure to maintain reasonable security could be an unfair practice, grounding that assumption in the common law of negligence. It then vacated the Commission's order anyway. The order did not prohibit any specific act or practice. It commanded LabMD to overhaul its security program to meet an "indeterminable standard of reasonableness," which the court said would leave the meaning of compliance to be worked out in contempt proceedings and would effectively put the court in charge of managing the company's security.

LabMD did not end FTC security enforcement. It changed how the orders are written. Since about 2019, FTC security orders specify required safeguards (MFA, encryption, data deletion, logging, named controls), make the outside assessor's work more rigorous and reviewable, require a senior officer to certify compliance to the Commission every year, and require the company to report future incidents to the FTC. The more specific the order, the easier it is to prove a violation.

What recent orders demand

The FTC's orders since 2022 read like a punch list, and they are the closest thing the country has to a federal security code for unregulated businesses:

• Drizly (2023). In addition to the CEO provision described above, the order requires deleting data the company does not need, publishing a data retention schedule, and using phishing-resistant MFA for access to consumer data.
• Chegg (2023). After four data breaches between 2017 and 2020, the education company was ordered to adopt a data retention schedule, honor consumer requests to access and delete data, offer MFA to its users, and use MFA internally. The complaint stressed that Chegg had protected stored passwords with an outdated hashing function and left other sensitive data unencrypted.
• Ring (2023). In a federal court settlement, Amazon's home camera subsidiary agreed to pay $5.8 million for consumer refunds. The FTC alleged that employees and contractors could view customers' private videos and that Ring was slow to adopt MFA and other protections against credential-stuffing attacks that let hackers take over cameras and harass users.
• Blackbaud (2024). The fundraising software provider suffered a 2020 ransomware attack and paid the attacker. The FTC's complaint treated keeping data the company no longer needed as an unfair practice in its own right and faulted the company's delayed and inaccurate notices to its customers. The order requires deleting unneeded data and maintaining a retention schedule.
• Marriott (2024). Following three breaches between 2014 and 2020, the FTC order requires a comprehensive security program, data minimization, and a way for customers to request deletion of their data; Marriott separately agreed to pay $52 million to a coalition of state attorneys general.
• GoDaddy (proposed January 2025). The FTC alleged that the web host failed to maintain an asset inventory, manage software updates, log and monitor security events, and segment its shared hosting environment, while marketing its hosting as secure.

Read together, the orders tell any business what the FTC expects: an inventory of systems and data; MFA everywhere, phishing-resistant for sensitive access; encryption; patching on a schedule; logging that someone reviews; segmentation; vendor oversight; and deletion of data the business does not need. Data minimization is now a security requirement, not just a privacy preference. See Data Minimization and Avoiding the Over-Retention of Personal Information.

Remedies after AMG Capital

The FTC's leverage depends on what it can get. In AMG Capital Management, LLC v. FTC, 593 U.S. 67 (2021), the Supreme Court held that Section 13(b), 15 U.S.C. § 53(b), authorizes injunctions but not restitution or disgorgement. For a first-time security violation of Section 5, then, the FTC's usual remedy is an order, not a check. The money comes later and in other ways:

• Order violations. A company that violates a final FTC order faces civil penalties of more than $50,000 per violation, adjusted each year for inflation. 15 U.S.C. § 45(l). Each day of a continuing failure can be a separate violation. Twenty years is a long time to comply perfectly.
• Rule violations. Where a regulation is treated as a trade regulation rule under Section 18, 15 U.S.C. § 57a, knowing violations carry civil penalties from the first offense. The Health Breach Notification Rule is in that category.
• Consumer redress. Section 19, 15 U.S.C. § 57b, permits redress for rule violations and, after an administrative order, for conduct a reasonable person would have known was dishonest or fraudulent.

The other practical lever is the states. Every state has a "little FTC Act" enforced by its attorney general, and the states routinely join or follow FTC security cases. Equifax's 2019 settlement with the FTC, the Consumer Financial Protection Bureau, and the states was worth at least $575 million. For providers of consumer financial products, the CFPB can bring its own unfairness case under 12 U.S.C. § 5531; its 2022 Circular 2022-04 said that inadequate security, including failure to require MFA, to manage passwords, and to update software in a timely way, can be an unfair practice.

Who the FTC cannot reach

Section 5 excludes banks, savings associations, and federal credit unions (left to the banking agencies), common carriers when they act as common carriers (left to the FCC), and nonprofit organizations. The common carrier exclusion is activity-based, so a telecom company's non-carrier business is within the FTC's reach. FTC v. AT&T Mobility LLC, 883 F.3d 848 (9th Cir. 2018) (en banc). Insurance is regulated mainly by the states. Everyone else, from a local orthodontist's billing service to a global software company, is an FTC company for security purposes.

The GLBA Safeguards Rule, as amended

The statute and the rule

Title V of the Gramm-Leach-Bliley Act directed each federal financial regulator to set standards for safeguarding customer information, so as to "insure the security and confidentiality of customer records," "protect against any anticipated threats or hazards," and "protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer." 15 U.S.C. § 6801(b). Enforcement is divided by type of institution: the banking agencies for banks, the National Credit Union Administration for federal credit unions, the SEC for broker-dealers and advisers, state insurance regulators for insurers, and the FTC for everyone else. 15 U.S.C. § 6805. The FTC's version is the Safeguards Rule, 16 C.F.R. Part 314.

The original 2002 rule was a few paragraphs long and asked for a "reasonable" program with five elements. The FTC rewrote it in a final rule published in December 2021 (86 Fed. Reg. 70,272), with the new prescriptive requirements taking effect on June 9, 2023, and added a notice requirement in a November 2023 amendment (88 Fed. Reg. 77,499) effective May 13, 2024. The amended rule borrows heavily from NYDFS Part 500 and is now the most detailed federal security rule that applies to ordinary businesses.

Who counts as a "financial institution"

This is where most companies get surprised. A "financial institution" is any institution whose business is "engaging in an activity that is financial in nature or incidental to such financial activities" under section 4(k) of the Bank Holding Company Act. 15 U.S.C. § 6809(3); 12 U.S.C. § 1843(k). The rule's own list of covered businesses includes mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisers, tax preparation firms, real estate settlement services, appraisers, travel agencies operated in connection with financial services, investment advisers not registered with the SEC, and "finders" that bring buyers and sellers together for transactions the parties negotiate themselves. 16 C.F.R. § 314.1(b), § 314.2(h).

Two categories deserve special mention:

• Auto dealers. A dealer that leases vehicles for more than 90 days, or that arranges financing for buyers, is a financial institution for that part of its business. Most dealers are also outside the Consumer Financial Protection Bureau's authority, 12 U.S.C. § 5519, which leaves the FTC as their primary federal security regulator. The FTC's 2019 case against LightYear Dealer Technologies, a dealer software provider whose unsecured backup database exposed data on about 12.5 million consumers held by roughly 130 dealers, was pleaded as a Safeguards Rule case.
• Retailers and fintechs. A retailer that issues its own credit card is covered; one that merely accepts Visa is not. Buy-now-pay-later providers, earned-wage-access apps, crypto platforms, and payment facilitators frequently are.

The rule protects "customer information," meaning nonpublic personal information about customers, and it applies to all such information in the institution's possession, including information about customers of other financial institutions that was provided to it. That last clause catches service providers who never deal with a consumer directly.

The required elements

Section 314.4 lists the elements, and each one is a separate, provable obligation:

Institutions that hold customer information on fewer than 5,000 consumers are excused from four of these: the written risk assessment, the continuous monitoring or penetration testing requirement, the written incident response plan, and the annual board report. 16 C.F.R. § 314.6. Everything else applies to a two-person tax practice.

The thirty-day FTC notice

Since May 13, 2024, a financial institution that discovers a "notification event" involving the information of at least 500 consumers must notify the FTC "as soon as possible, and no later than 30 days after discovery," through a form on the FTC's website. 16 C.F.R. § 314.4(j). A notification event is the acquisition of unencrypted customer information without the consumer's authorization. Three details drive the analysis:

• Access is presumed to be acquisition unless the institution has "reliable evidence" that the information was not, and could not reasonably have been, acquired. Without good logs, that evidence rarely exists.
• Encrypted data counts as unencrypted if the key was also compromised.
• Discovery is imputed. The event is discovered on the first day it is known to any employee, officer, or agent other than the person committing the breach.

The notice must describe the information involved, the date range, the number of consumers, and a general description of the event. A law enforcement official may request a delay of up to 30 days, extendable by up to 60 more on a written request. The FTC has said it intends to make the notices publicly available, which turns a regulatory filing into a press event and a plaintiffs' lead list.

Enforcement reality

The FTC enforces the Safeguards Rule through its ordinary Section 5 tools. For years it has asked Congress for civil penalty authority over data security violations, including violations of the GLBA rules, which tells you it does not believe it can fine a company for a first violation. The practical exposure is therefore a twenty-year order with outside assessments, penalties for any later violation of that order, and the parallel exposure that a breach creates: state attorneys general, class actions, and, for companies that also hold card data, the card brands. The rule's real force is evidentiary. Its specificity makes "reasonable security" concrete, and plaintiffs now plead its elements as the standard of care even against companies it does not formally reach.

Two related FTC rules round out the financial picture: the Disposal Rule under the Fair and Accurate Credit Transactions Act, which requires reasonable measures to destroy consumer report information, 16 C.F.R. Part 682; 15 U.S.C. § 1681w, and the Red Flags Rule, which requires creditors to run an identity theft prevention program, 16 C.F.R. Part 681.

The bank and credit union counterparts

Banks follow the Interagency Guidelines Establishing Information Security Standards, which are appendices to the agencies' safety and soundness rules, for example 12 C.F.R. Part 30 (OCC) and 12 C.F.R. Part 364 (FDIC). Since 2022, the banking agencies' computer-security incident notification rule requires a bank to notify its primary federal regulator within 36 hours after determining that a "notification incident" has occurred, and requires bank service providers to alert their bank customers when an incident disrupts covered services for four hours or more. 12 C.F.R. Part 53. Federally insured credit unions must report a reportable cyber incident to the NCUA within 72 hours. 12 C.F.R. Part 748.

NYDFS Part 500 after the November 2023 amendments

Who is covered

New York's cybersecurity regulation, 23 NYCRR Part 500, took effect in 2017 and was substantially amended on November 1, 2023. It applies to any "covered entity," meaning any person operating, or required to operate, under a license, registration, charter, certificate, permit, or similar authorization under New York's Banking Law, Insurance Law, or Financial Services Law. That reaches state-chartered banks, licensed lenders and mortgage servicers, money transmitters, virtual currency businesses, insurers, and insurance agents and brokers. It reaches them even when they are also regulated by a federal agency, and it reaches out-of-state companies that hold a New York license.

The 2023 amendment created three tiers:

• Class A companies have at least $20 million in gross annual revenue from New York business in each of the last two fiscal years (including affiliates' New York business) and either more than 2,000 employees averaged over two years or more than $1 billion in annual global revenue, in each case counting all affiliates. They must commission independent audits of the program, use a privileged access management solution and automated blocking of commonly used passwords, and deploy endpoint detection and response with centralized logging and alerting.
• Limited-exemption entities have fewer than 20 employees and independent contractors, or less than $7.5 million in New York-related gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets (counting affiliates). They are excused from many technical provisions but must still maintain a policy, conduct risk assessments, limit access privileges, use MFA, give notice of incidents, and certify compliance.
• Everyone else must comply with all of Part 500 except the Class A extras.

Governance and personal accountability

Part 500 is the regulation that put names on the line. Each covered entity must designate a chief information security officer (CISO) with "adequate authority" to manage cyber risk, who must report to the senior governing body in writing at least annually and must report material cybersecurity issues in a timely way. The board (or other senior governing body) must have "sufficient understanding of cybersecurity-related matters to exercise such oversight," must require management to maintain the program, and must confirm that management has allocated sufficient resources. The written policies must be approved at least annually by a senior officer or the board.

Every April 15, each covered entity must file either a certification that it materially complied with Part 500 during the prior calendar year or a written acknowledgment of noncompliance that identifies every provision it missed and its remediation timeline. Since the amendment, the filing must be signed by the highest-ranking executive and the CISO. An executive who signs a false certification has made a personal statement to a regulator; the old practice of having a compliance manager sign is gone.

Technical requirements and the phased dates

The amended regulation requires, among other things, an annually reviewed risk assessment; an asset inventory; annual penetration testing from inside and outside the network; automated vulnerability scans; access privilege reviews at least annually; MFA for remote access, for third-party applications holding nonpublic information, and, by the final phase, for all individuals accessing any information system; encryption of nonpublic information in transit over external networks and at rest; annual training that covers social engineering; written incident response and business continuity plans that are tested at least annually with senior officers participating; backups protected from alteration or destruction; and a written third-party service provider policy with due diligence and contract terms.

The amendment phased in over two years. The notification changes took effect December 1, 2023; the new certification form applied from April 15, 2024; and the last phase, universal MFA and the full asset inventory requirement, takes effect November 1, 2025. Entities should treat every provision as live by that date.

The 72-hour and 24-hour notices

A covered entity must notify the Superintendent electronically "as promptly as possible but in no event later than 72 hours after determining" that a cybersecurity incident has occurred at the entity, its affiliates, or a third-party service provider. A cybersecurity incident is a cybersecurity event that has a reasonable likelihood of materially harming any material part of normal operations, that requires notice to any government body, self-regulatory agency, or other supervisory body, or that results in the deployment of ransomware within a material part of the entity's information systems. The entity must then answer the Department's questions and update its notice as facts develop.

If the entity makes an extortion payment, it must notify the Department within 24 hours of the payment and, within 30 days, explain in writing why payment was necessary, what alternatives it considered, what diligence it did to find alternatives, and what diligence it did to comply with applicable law, including the OFAC sanctions rules discussed below.

Enforcement

NYDFS enforces Part 500 through investigations and consent orders under the Financial Services Law, and its penalties run into seven and eight figures. Examples include a $4.5 million consent order with EyeMed Vision Care in 2022 after a phishing attack on an email account that lacked MFA, and a $5 million order with Carnival's cruise lines in 2022 for, among other things, MFA failures and late notice. The amended regulation says expressly that a single act or failure to act can be a violation, as can material failure to comply with any section for any 24-hour period, which lets the Department count violations by the day.

SEC cybersecurity disclosure for public companies

The SEC does not tell public companies how to secure their networks. It tells them what they must say about security, and it polices whether what they say is true. In July 2023 it adopted rules (88 Fed. Reg. 51,896) that do two things: require prompt disclosure of material incidents, and require annual disclosure of risk management and governance.

Form 8-K Item 1.05: the four-business-day clock

If a registrant "experiences a cybersecurity incident that is determined by the registrant to be material," it must file a Form 8-K under Item 1.05 describing "the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations." The filing is due within four business days after the materiality determination, and the determination itself must be made "without unreasonable delay after discovery of the incident." Form 8-K is prescribed by 17 C.F.R. § 249.308, and the reporting duty runs through Section 13(a) of the Exchange Act, 15 U.S.C. § 78m. Most registrants have been subject to Item 1.05 since December 18, 2023; smaller reporting companies since June 15, 2024.

Several features of Item 1.05 shape practice:

• The clock runs from the determination, not discovery. But a company that sits on the determination is violating the "without unreasonable delay" instruction. Boards should expect the SEC to reconstruct the timeline from tickets, emails, and forensic reports.
• Unknowns are disclosed as unknowns. If required information is not determined or available when the 8-K is due, the company says so and files an amendment within four business days after the information becomes available.
• Technical detail is not required. The company need not disclose specific or technical information about its response or vulnerabilities in a way that would impede remediation.
• A national security delay exists but is narrow. Disclosure may be delayed only if the U.S. Attorney General determines that it would pose a substantial risk to national security or public safety and notifies the SEC in writing; the delay runs 30 days, can be extended by another 30, and in extraordinary circumstances by 60 more. The Department of Justice and FBI have published procedures for requesting a delay, and the standard is demanding.
• Carriers get a short delay. A registrant subject to the FCC's customer proprietary network information rule, 47 C.F.R. § 64.2011, may delay up to seven business days to align with the law enforcement notice that rule requires.
• A late Item 1.05 filing is not fatal by itself. The SEC preserved Form S-3 eligibility and extended the limited safe harbor in Exchange Act Rule 13a-11(c), 17 C.F.R. Part 240, so that failure to file an Item 1.05 report on time is not itself a Rule 10b-5 violation. The underlying misstatements, if any, still are.

Materiality, and what to do with an incident that is not (yet) material

Materiality is the familiar securities standard: a fact is material if there is "a substantial likelihood that a reasonable shareholder would consider it important," TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976), because it would significantly alter the "total mix" of information available. For contingent or developing events, materiality depends on "a balancing of both the indicated probability that the event will occur and the anticipated magnitude of the event." Basic Inc. v. Levinson, 485 U.S. 224 (1988). There is no bright-line numerical test. Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27 (2011).

The adopting release told companies to consider qualitative factors as well as quantitative ones: harm to reputation, customer or vendor relationships, and competitiveness, and the possibility of litigation or regulatory investigations. A ransomware attack that costs little to remediate can still be material if it exposed customer data, interrupted a flagship product, or invites regulators. And because a "cybersecurity incident" includes "a series of related unauthorized occurrences," 17 C.F.R. § 229.106(a), a run of small intrusions by the same actor through the same weakness may need to be assessed together. The staff has also said that the size of a ransom payment, or the fact that an attack has ended, does not by itself make an incident immaterial.

Early practice produced a problem the SEC did not intend: companies filed Item 1.05 reports for incidents they had not determined to be material, out of caution or to get ahead of the news. In May 2024 the Director of the Division of Corporation Finance issued a statement steering those voluntary disclosures to Item 8.01 ("Other Events") and reserving Item 1.05 for incidents the company has actually determined to be material. If a company discloses under Item 8.01 and later determines the incident is material, it then files under Item 1.05 within four business days of that determination.

Regulation S-K Item 106: annual risk management and governance disclosure

Item 106 requires every Form 10-K to describe, "in sufficient detail for a reasonable investor to understand," the company's processes for assessing, identifying, and managing material cyber risks, including whether those processes are integrated into enterprise risk management, whether the company uses outside assessors, and whether it has processes to oversee risks from third-party service providers. It must also say whether any cyber risks, including from previous incidents, have materially affected or are reasonably likely to materially affect the business. On governance, the company must describe the board's oversight (and any responsible committee), management's role, the relevant expertise of the responsible managers, and how they are informed about and report on incidents. 17 C.F.R. § 229.106(b), (c). The SEC dropped a proposed requirement to disclose directors' cyber expertise.

Item 106's definitions matter. "Information systems" means resources "owned or used by the registrant," so an incident at a cloud provider or software vendor whose systems the company uses can be the company's incident for disclosure purposes.

The governance disclosure is where disclosure becomes substance. A company that writes "our audit committee receives quarterly briefings from the CISO" had better have the minutes. The description is also the first exhibit in any later derivative suit; see the board oversight section below.

Enforcement: what the SEC has charged

The SEC's cyber cases fall into three patterns.

1. Concealing a known incident. Altaba, formerly Yahoo, paid $35 million in 2018 for failing to disclose a 2014 breach of hundreds of millions of user accounts for about two years.
2. Describing a realized risk as hypothetical. Pearson paid $1 million in 2021 for describing a data breach as a hypothetical risk in a filing made after the breach had occurred. Blackbaud paid $3 million in 2023 after its public statements said the attacker had not accessed donors' bank account information or Social Security numbers, when its staff had learned otherwise and the information never reached the people responsible for disclosure.
3. Disclosure controls failures. First American Financial paid about $488,000 in 2021 because senior executives responsible for its public statements were never told that its security staff had identified, months earlier, the vulnerability that exposed hundreds of millions of document images. The obligation to maintain disclosure controls and procedures appears in Exchange Act Rule 13a-15, in 17 C.F.R. Part 240, and the CEO and CFO certify them under Section 302 of the Sarbanes-Oxley Act, 15 U.S.C. § 7241.

In October 2024 the SEC settled with four technology companies (Unisys, Avaya, Check Point, and Mimecast) for penalties between about $1 million and $4 million, alleging that each had minimized or described as hypothetical the intrusions it suffered in the SolarWinds supply-chain campaign. Two commissioners dissented, arguing that the SEC was second-guessing reasonable disclosure judgments with hindsight.

SEC v. SolarWinds

The SEC's most aggressive cyber case charged both SolarWinds and its chief information security officer, Timothy Brown, with fraud. The theory was that for years before the 2020 SUNBURST attack, SolarWinds' public "Security Statement" on its website, and Brown's public comments, described access controls, password practices, and secure development processes that internal documents showed the company did not have.

In SEC v. SolarWinds Corp., 741 F. Supp. 3d 37 (S.D.N.Y. 2024), the court let the fraud claims based on the Security Statement proceed, because they were specific representations about practices the SEC plausibly alleged were false. It dismissed nearly everything else: claims based on the company's risk-factor disclosures, on press releases, blog posts, and podcasts it found to be non-actionable puffery, and on the 8-K reports filed after the attack. Most important for compliance programs, it dismissed the claim that weak cybersecurity was a failure of "internal accounting controls" under Section 13(b)(2)(B), 15 U.S.C. § 78m(b)(2)(B), holding that the phrase refers to controls over financial transactions and assets, not every system a company uses to protect itself. As of this writing, the surviving claims remain pending.

The lessons are durable no matter how that case ends. A security page on a website is a statement to investors as well as to customers. A CISO who speaks publicly about the company's security is making representations that can be tested against internal documents. And the internal documents (risk registers, audit findings, Slack messages that say "we are so far from compliant") are what the case will be about.

Private securities litigation

Shareholders sue under Section 10(b), 15 U.S.C. § 78j(b), and must plead with particularity facts giving rise to a strong inference of scienter under the Private Securities Litigation Reform Act, 15 U.S.C. § 78u-4; Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308 (2007). The cyber cases have gone both ways:

• Construction Laborers Pension Trust v. Marriott International, Inc., 31 F.4th 898 (4th Cir. 2022), affirmed dismissal: Marriott's statements about the importance of protecting data, and its risk warnings, did not misrepresent the state of the Starwood systems it had acquired.
• In re Alphabet, Inc. Securities Litigation, 1 F.4th 687 (9th Cir. 2021), revived claims that Alphabet's risk factors warned that security problems "could" occur while the company knew a Google+ vulnerability had already exposed user data. In re Facebook, Inc. Securities Litigation, 87 F.4th 934 (9th Cir. 2023), applied the same reasoning to data misuse risks that had already materialized.
• In re Equifax Inc. Securities Litigation, 357 F. Supp. 3d 1189 (N.D. Ga. 2019), and In re SolarWinds Corp. Securities Litigation, 595 F. Supp. 3d 573 (W.D. Tex. 2022), let claims proceed where plaintiffs pleaded specific gaps between public statements and known internal conditions; in SolarWinds the court sustained claims against the company and its security executive while dismissing the former CEO.

Two Supreme Court decisions frame the defense. Statements of opinion ("we believe our security measures are adequate") are actionable only if not sincerely held, if they contain embedded false facts, or if they omit facts about the basis for the opinion that make it misleading. Omnicare, Inc. v. Laborers District Council Construction Industry Pension Fund, 575 U.S. 175 (2015). And a pure omission of information a regulation requires, without a statement rendered misleading, does not support a private claim under Rule 10b-5(b). Macquarie Infrastructure Corp. v. Moab Partners, L.P., 601 U.S. 257 (2024). Macquarie limits private suits over a missing Item 1.05 report; it does not limit the SEC. For the litigation framework, see Securities Fraud Litigation Under Rule 10b-5: Elements, the PSLRA, and Defense Strategy.

Market participants: Regulation S-P and Regulation SCI

Broker-dealers, registered investment advisers, investment companies, and transfer agents face more than disclosure. Regulation S-P, 17 C.F.R. Part 248, has long required written safeguards and disposal policies. The 2024 amendments add a written incident response program to detect, respond to, and recover from unauthorized access to customer information; require notice to affected individuals as soon as practicable and no later than 30 days after the firm becomes aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization; and require policies under which service providers notify the firm within 72 hours of a breach affecting customer information systems. Larger entities must comply by December 3, 2025, and smaller ones by June 3, 2026. Exchanges, clearing agencies, and other "SCI entities" are also subject to Regulation SCI, 17 C.F.R. §§ 242.1000-242.1007, which requires policies for systems capacity, integrity, resiliency, and security and prompt notice of "SCI events." The SEC's separate 2022 and 2023 proposals for adviser and broker-dealer cybersecurity rules remain proposals. For the adviser and broker-dealer regulatory context, see Investment Adviser and Broker-Dealer Regulation: Registration, Fiduciary Duty, and Examinations.

State security laws: Massachusetts, New York, California, and the safe harbors

Most states have a breach notification statute; fewer have a statute that tells businesses how to secure data in the first place. The ones that do set the floor for any company with customers or employees in those states.

Massachusetts: the written information security program

The Massachusetts regulation, 201 CMR 17.00, applies to every person that "owns or licenses" personal information about a Massachusetts resident, wherever the business is located. Personal information means a name combined with a Social Security number, a driver's license or state ID number, or a financial account or card number. The regulation requires a written information security program (WISP) with administrative, technical, and physical safeguards appropriate to the business's size, resources, and data. Its required elements are familiar now but were novel in 2010: a designated employee responsible for the program; identification and assessment of reasonably foreseeable risks; policies on storing, accessing, and transporting records; discipline for violations; prompt termination of departing employees' access; contractual oversight of service providers; physical access restrictions; regular monitoring; at least annual review; and documentation of the response to any incident. Section 17.04 adds computer-system requirements: secure authentication and access controls, encryption of personal information sent across public networks or wirelessly and stored on laptops and portable devices, firewalls and current patches, current malware protection, and training. The Attorney General enforces it under the state's consumer protection statute.

New York: the SHIELD Act

New York's Stop Hacks and Improve Electronic Data Security (SHIELD) Act, N.Y. Gen. Bus. Law § 899-bb, requires any person or business that owns or licenses computerized "private information" of a New York resident to "develop, implement and maintain reasonable safeguards." A business already in compliance with the GLBA, HIPAA, or Part 500 is deemed compliant. Everyone else must have a program with listed administrative safeguards (a designated coordinator, risk identification, training, vendor selection and contracts), technical safeguards (risk assessment of network and software design, detection and response, regular testing), and physical safeguards (secure storage and disposal within a reasonable time after the data is no longer needed). Small businesses (fewer than 50 employees, under $3 million in annual revenue, or under $5 million in assets) may scale the program to their size. There is no private right of action; the Attorney General may seek civil penalties of up to $5,000 per violation.

California: reasonable security and the only private right of action that bites

California Civil Code § 1798.81.5 requires a business that owns, licenses, or maintains personal information about California residents to "implement and maintain reasonable security procedures and practices appropriate to the nature of the information," and to require the same of third parties by contract. Section 1798.150, part of the California Consumer Privacy Act, gives consumers a private right of action when their nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure "as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices." Plaintiffs may recover statutory damages (set at $100 to $750 per consumer per incident, with periodic inflation adjustments) or actual damages, whichever is greater. Before seeking statutory damages, the consumer must give 30 days' notice and an opportunity to cure, and the statute says that implementing reasonable security after a breach is not a cure. Statutory damages multiplied by a class is why California counts appear in nearly every national breach complaint.

What "reasonable" means in California has an unusual official gloss. The Attorney General's 2016 Data Breach Report said the CIS Critical Security Controls "define a minimum level of information security" and that failing to implement all of the controls that apply to an organization's environment "constitutes a lack of reasonable security." The California Privacy Protection Agency has also proposed regulations that would require annual cybersecurity audits for businesses whose processing presents significant risk. For California's broader privacy regime, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

The other states, and the comprehensive privacy laws

At least a dozen other states, including Texas, Florida, Illinois, Oregon, and Colorado, require "reasonable" security for personal information without much elaboration. Nevada requires data collectors that accept payment cards to comply with PCI DSS and to encrypt personal information in transmission and on movable devices. Minnesota's Plastic Card Security Act makes businesses that retain card data too long liable to card-issuing banks for breach costs. And every comprehensive state privacy law enacted since 2021, from Virginia to Colorado to Oregon, contains a duty to maintain reasonable administrative, technical, and physical data security practices, enforced by the state attorney general.

Safe-harbor statutes

A handful of states reward companies that adopt a recognized framework. Ohio's Data Protection Act (Ohio Rev. Code ch. 1354) gives an affirmative defense to tort claims arising from a breach for a business whose written program reasonably conforms to a listed framework, such as the NIST Cybersecurity Framework, NIST SP 800-171 or 800-53, the CIS Controls, or ISO/IEC 27001. Utah enacted a similar affirmative defense in 2021, Connecticut bars punitive damages in breach tort suits against businesses that maintain a conforming program, and Iowa followed in 2023. The defenses are narrow (they do not stop regulators, and most do not reach contract or statutory claims), but they are free, and they put a premium on documenting conformity.

Insurance: the NAIC model law

The NAIC Insurance Data Security Model Law, adopted by more than twenty states, applies to insurers, agencies, and other licensees of a state insurance department. It requires an information security program based on a risk assessment, board oversight, third-party service provider oversight, an incident response plan, an annual written certification to the commissioner by February 15, and notice to the commissioner within 72 hours after determining that a cybersecurity event has occurred. Licensees with fewer than ten employees and those in compliance with HIPAA are generally exempt. States vary on the details, so a multistate insurer must check each enactment.

PCI DSS: contract law with teeth

The Payment Card Industry Data Security Standard is not law. It is a set of security requirements the card brands impose on merchants and processors through the merchant agreements that let them accept cards. Version 4.0's "future-dated" requirements became mandatory on March 31, 2025. Its legal force comes from three places: the merchant agreement (which makes the merchant liable for card-brand assessments after a breach), a few state statutes such as Nevada's, and its use as evidence of the standard of care. How much a breached merchant pays often turns on contract drafting. In Schnuck Markets, Inc. v. First Data Merchant Services Corp., 852 F.3d 732 (8th Cir. 2017), the Eighth Circuit held that a $500,000 limitation-of-liability clause in the grocery chain's processing agreement capped its exposure for card-network assessments covering issuing banks' losses, which ran to millions of dollars. Issuing banks can also sue processors in tort: in Lone Star National Bank, N.A. v. Heartland Payment Systems, Inc., 729 F.3d 421 (5th Cir. 2013), the Fifth Circuit held that New Jersey's economic loss doctrine did not bar the banks' negligence claims against a processor whose breach exposed their cardholders' data.

Sector rules: health, telecommunications, defense, energy, transportation, and critical infrastructure

Health data: the HIPAA Security Rule and the FTC's Health Breach Notification Rule

The HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C, applies to covered entities (health plans, clearinghouses, and providers that bill electronically) and, since the HITECH Act, directly to their business associates. 42 U.S.C. § 17931. It requires an "accurate and thorough" risk analysis, risk management to reduce risks to a reasonable level, and administrative, physical, and technical safeguards, some "required" and some "addressable." Addressable does not mean optional; it means the entity must implement the specification or document why an alternative is reasonable. Penalties are tiered by culpability. 42 U.S.C. § 1320d-5. Definitions of covered entities and business associates are in 45 C.F.R. § 160.103.

The Department of Health and Human Services' Office for Civil Rights (OCR) cites a missing or inadequate risk analysis in most of its security settlements. Its penalties have limits, though. In University of Texas M.D. Anderson Cancer Center v. HHS, 985 F.3d 472 (5th Cir. 2021), the Fifth Circuit vacated a $4.3 million penalty, holding among other things that the encryption standard requires a mechanism for encryption, not perfect encryption of every device, and that the agency had treated similarly situated entities inconsistently. A 2021 amendment to HITECH also requires HHS to consider whether an entity had "recognized security practices" in place for the prior twelve months when setting penalties.

In January 2025, HHS proposed the first major overhaul of the Security Rule (90 Fed. Reg. 898). The proposal would eliminate the distinction between required and addressable specifications and would require, among other things, a written asset inventory and network map, MFA, encryption, vulnerability scanning every six months, annual penetration testing, the ability to restore critical systems within 72 hours, and annual verification of business associates' safeguards. It is a proposal; watch for a final rule.

Health apps and other businesses that hold health data outside HIPAA answer to the FTC. Its Health Breach Notification Rule, 16 C.F.R. Part 318, issued under 42 U.S.C. § 17937, was amended effective July 29, 2024 to confirm that health and fitness apps are covered, that a "breach of security" includes an unauthorized disclosure (such as sharing data with an advertising platform) and not only a hack, and that notice to the FTC for breaches of 500 or more people is due at the same time as notice to individuals, within 60 days of discovery. Violations carry civil penalties per violation, as the FTC showed in its 2023 cases against GoodRx ($1.5 million) and the fertility app Premom. For the HIPAA program in depth, see HIPAA Privacy and Security Compliance for Covered Entities and Business Associates.

Telecommunications: CPNI and the FCC's 2023 breach order

Section 222 of the Communications Act requires every telecommunications carrier to protect the confidentiality of customer proprietary network information (CPNI), the data about who customers call and what services they use. 47 U.S.C. § 222. The FCC enforces it through consent decrees; AT&T paid $25 million in 2015 after call-center employees at vendors sold customer data. In December 2023 the FCC expanded its breach rule, 47 C.F.R. § 64.2011, to cover all personally identifiable information, to include inadvertent disclosures, and to require notice to the FCC, the FBI, and the Secret Service within seven business days and to customers within 30 days unless the carrier reasonably determines that harm is unlikely. Industry groups challenged the order in the Sixth Circuit.

Defense contractors: DFARS 7012, NIST SP 800-171, and CMMC

A defense contractor that handles controlled unclassified information must provide "adequate security" by implementing the 110 requirements of NIST SP 800-171, report cyber incidents to the Department of Defense within 72 hours of discovery, preserve images of affected systems for 90 days, and flow the clause down to subcontractors. DFARS 252.204-7012, 48 C.F.R. Part 252. Contractors handling only federal contract information must meet the fifteen basic safeguarding requirements of FAR 52.204-21, 48 C.F.R. Part 52. The Cybersecurity Maturity Model Certification (CMMC) program, codified at 32 C.F.R. Part 170 effective December 16, 2024, adds verification: annual self-assessment at Level 1, self-assessment or third-party certification at Level 2 depending on the information, and government assessment at Level 3, with senior officials affirming compliance. CMMC enters contracts through a DFARS clause (252.204-7021) and a phased rollout tied to that acquisition rule.

The sharpest teeth here are not contractual. The Department of Justice's Civil Cyber-Fraud Initiative, launched in 2021, uses the False Claims Act, 31 U.S.C. § 3729, against contractors that misrepresent their security compliance. In United States ex rel. Markus v. Aerojet Rocketdyne Holdings, Inc., 381 F. Supp. 3d 1240 (E.D. Cal. 2019), the court refused to dismiss a whistleblower's claim that the company misrepresented its compliance with DFARS cybersecurity requirements; the case later settled for $9 million. Materiality under the False Claims Act is demanding, Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016), but a CMMC affirmation signed by a named executive will make it easier to prove. See False Claims Act Qui Tam Litigation: The Seal, Materiality, Scienter, and Government Intervention.

Energy, pipelines, and rail

Owners and operators of the bulk electric system must comply with the NERC Critical Infrastructure Protection (CIP) reliability standards, which FERC approves and enforces under section 215 of the Federal Power Act, 16 U.S.C. § 824o; 18 C.F.R. Part 40. Penalties can exceed $1 million per violation per day. After the 2021 Colonial Pipeline ransomware attack, the Transportation Security Administration used its emergency authority, 49 U.S.C. § 114, to issue security directives requiring designated pipeline and rail operators to name a cybersecurity coordinator, report significant incidents to CISA within hours, segment operational technology, and adopt tested incident response plans. TSA proposed in November 2024 to codify those requirements alongside its existing rail security rules, such as 49 C.F.R. Part 1580.

CIRCIA: the coming cross-sector reporting duty

The Cyber Incident Reporting for Critical Infrastructure Act of 2022, 6 U.S.C. §§ 681-681g, requires covered entities in the sixteen critical infrastructure sectors to report covered cyber incidents to CISA within 72 hours after reasonably believing one occurred, and to report ransom payments within 24 hours of paying. 6 U.S.C. § 681b. The duties take effect only when CISA's final rule does. CISA published its proposed rule in April 2024; it would reach a large share of mid-size and large companies in covered sectors. Until the final rule takes effect, reporting to CISA is voluntary.

How regulators and courts actually measure "reasonable security"

Almost every regime above uses some version of the word "reasonable," and none defines it numerically. In practice, the standard is assembled from five sources, and a company that wants to defend its program should be able to point to each.

1. A recognized framework. The NIST Cybersecurity Framework (version 2.0, released in February 2024, which added a "Govern" function to Identify, Protect, Detect, Respond, and Recover), NIST SP 800-53 for detailed controls, NIST SP 800-171 for controlled unclassified information, the CIS Critical Security Controls, and ISO/IEC 27001 certification. None is legally required for most companies. All of them are the vocabulary in which regulators, auditors, insurers, and expert witnesses speak.
2. The prescriptive rules, used as benchmarks. The Safeguards Rule and Part 500 now list specific controls. Even where they do not formally apply, plaintiffs plead them as evidence of what a reasonable company does, and regulators cite them in investigations of companies outside their scope.
3. The FTC's orders and guidance. Two decades of complaints describe what the FTC considers unreasonable: unpatched known vulnerabilities, default credentials, no MFA on remote and administrative access, flat networks, unencrypted sensitive data, no logging, no vendor oversight, and keeping data forever. The FTC's "Start with Security" guidance distills them.
4. Industry practice and the company's own promises. Contracts, security questionnaires, SOC 2 reports, and the company's own policies set expectations. A company that does not follow its own written policy has a hard time arguing that the policy's standard was unreasonable.
5. What the company knew. The single most damaging fact in any security case is a document showing the company knew about the exact weakness that was exploited and did not fix it or formally accept the risk.

Negligence: is there a common-law duty to secure data?

Most courts now say yes, at least when the company collected the data and knew the risk. In Dittman v. UPMC, 196 A.3d 1036 (Pa. 2018), the Pennsylvania Supreme Court held that an employer that required employees to provide sensitive information as a condition of employment owed them a duty to exercise reasonable care to safeguard it on an internet-accessible system, and that the economic loss doctrine did not bar the claim because the duty arose independently of any contract. In In re Equifax, Inc. Customer Data Security Breach Litigation, 362 F. Supp. 3d 1295 (N.D. Ga. 2019), the court found a duty under Georgia law where the company allegedly knew of a foreseeable risk and failed to implement reasonable security, and held that Section 5 of the FTC Act could supply the standard for a negligence per se claim. Other courts reached similar results for retailers and insurers. See In re Target Corp. Customer Data Security Breach Litigation, 66 F. Supp. 3d 1154 (D. Minn. 2014); In re Anthem, Inc. Data Breach Litigation, 162 F. Supp. 3d 953 (N.D. Cal. 2016). Results still vary by state on the economic loss rule and on whether a statute without a private right of action can set the standard of care, so choice of law matters.

Banking law has its own "reasonable security" test. Under UCC Article 4A, a bank bears the loss from a fraudulent wire unless its security procedure was "commercially reasonable" and followed in good faith. Compare Patco Construction Co. v. People's United Bank, 684 F.3d 197 (1st Cir. 2012) (bank's procedures not commercially reasonable where it triggered challenge questions on every transaction, making the answers easy for keyloggers to capture, and did nothing when its own system scored the fraudulent transfers as high risk), with Choice Escrow & Land Title, LLC v. BancorpSouth Bank, 754 F.3d 611 (8th Cir. 2014) (procedures reasonable where the customer declined the dual-control protection the bank offered).

Standing: the federal-court gatekeeper, and real circuit differences

Whether a breach victim can sue in federal court depends on Article III standing, and here the circuits genuinely differ. The Supreme Court's framework comes from Clapper v. Amnesty International USA, 568 U.S. 398 (2013) (threatened injury must be "certainly impending"), Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) (concreteness), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (a risk of future harm, standing alone, does not support a claim for damages unless the risk materializes or itself causes a separate concrete harm).

• The Seventh, Ninth, and D.C. Circuits have found standing where hackers targeted and stole sensitive data, reasoning that the purpose of the theft is fraud. Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015); Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir. 2017); In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018).
• The Fourth and Eleventh Circuits have been more demanding where there was no misuse. Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017) (stolen laptops, no evidence of targeting or misuse); Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332 (11th Cir. 2021) (self-imposed mitigation costs do not manufacture standing).
• The Second, Third, and First Circuits use multi-factor tests that ask whether the data was targeted, whether any of it has been misused, and how sensitive it is. McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2d Cir. 2021); Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022) (ransomware gang posted the data on the dark web); Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023); Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276 (2d Cir. 2023) (applying TransUnion and finding standing by analogy to the tort of public disclosure of private facts).

Standing doctrine shapes the duty to secure in a practical way. In the circuits friendliest to plaintiffs, a breach of sensitive data almost guarantees a class action that reaches discovery, and discovery is where the risk assessment, the audit findings, and the board minutes come out. For the doctrine in depth, see Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims.

Board oversight: Caremark, Marriott, and SolarWinds

Directors of Delaware corporations have a duty to make a good-faith effort to ensure that the company has a reporting system for compliance risks. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). Liability requires bad faith: either the directors "utterly failed to implement any reporting or information system or controls," or, having implemented one, they "consciously failed to monitor or oversee its operations." Stone v. Ritter, 911 A.2d 362 (Del. 2006). In Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), the Delaware Supreme Court let a claim proceed against the board of an ice cream maker that had no board-level system at all for monitoring food safety, its "mission critical" compliance risk. The Court of Chancery applied the same reasoning to Boeing's board and airplane safety in 2021 (In re Boeing Co. Derivative Litigation, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021)).

The cyber cases so far have been dismissed, but the opinions are warnings rather than reassurances.

• Marriott. In Firemen's Retirement System of St. Louis v. Sorenson, C.A. No. 2019-0965-LWW (Del. Ch. Oct. 5, 2021), the court dismissed claims arising from the Starwood breach because the complaint itself showed that the board and audit committee were "routinely apprised" of cyber risks, reviewed enterprise risk reports that addressed them, and engaged outside consultants and auditors. But the court also wrote that "as the legal and regulatory frameworks governing cybersecurity advance and the risks become manifest, corporate governance must evolve to address them." The defense won because the board had a documented system.
• SolarWinds. In Construction Industry Laborers Pension Fund v. Bingle, 2022 WL 4102492 (Del. Ch. Sept. 6, 2022), the court dismissed oversight claims against SolarWinds' directors because the plaintiffs pleaded neither a complete absence of a reporting system nor red flags the board consciously ignored; it treated cybersecurity there as a business risk, oversight of which rarely supports bad-faith liability. The Delaware Supreme Court affirmed on the basis of that opinion. Construction Industry Laborers Pension Fund v. Bingle, No. 411, 2022 (Del. May 17, 2023).
• Federal courts applying Delaware law have reached the same result. In re Home Depot, Inc. Shareholder Derivative Litigation, 223 F. Supp. 3d 1317 (N.D. Ga. 2016), dismissed claims because the board had a plan to address known security weaknesses, even if it moved slowly.

Three things have changed since those decisions. Delaware has extended oversight duties to officers, so a CISO or CIO with authority over security has a personal oversight duty in a Delaware company (In re McDonald's Corp. Stockholder Derivative Litigation, 289 A.3d 343 (Del. Ch. 2023)). Regulators now require the board's involvement in writing: the Safeguards Rule's annual report, Part 500's governance provisions, and Item 106's governance disclosure. And for regulated companies, cybersecurity is increasingly a matter of complying with positive law rather than managing business risk, which is the line Bingle drew. A board that receives no cyber reporting, in a company whose regulator requires it, is the next Marchand. For the governance mechanics, see Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight and Shareholder Derivative Litigation: Demand Futility, Special Litigation Committees, and Settlement.

Ransomware payments, sanctions, and the reporting overlay

Paying a ransom is not illegal as such. Paying one to a sanctioned person is, and the liability is strict. The Treasury Department's Office of Foreign Assets Control (OFAC) administers sanctions under the International Emergency Economic Powers Act, which imposes civil penalties for any violation regardless of knowledge and criminal penalties for willful ones. 50 U.S.C. § 1705. Several ransomware groups and the infrastructure that launders their proceeds have been designated, some under the cyber-related sanctions program, 31 C.F.R. Part 578. OFAC's 2021 Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments warns that the victim, its insurer, its incident response firm, and the negotiator can all be liable; says license applications for such payments will be reviewed with a presumption of denial; and lists as mitigating factors a meaningful cybersecurity program and prompt, complete reporting to law enforcement and cooperation. OFAC's Enforcement Guidelines appear in 31 C.F.R. Part 501, Appendix A.

A ransom decision therefore sits inside a web of reporting duties: NYDFS's 24-hour and 30-day extortion payment notices, CIRCIA's 24-hour ransom payment report once effective, suspicious activity reports by financial institutions that process payments, cyber insurance notice and consent provisions, and the SEC's materiality analysis. The best ransom decision is the one a company never has to make because its backups were immutable and tested. For the sanctions framework, see Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses.

Strategy for each side

For the regulated company, before anything happens

• Map the regimes first. List every license, every regulated data type, every contract that imposes security terms, and every state where customers or employees live. The map decides which rule is the "highest common denominator." For many companies it is the Safeguards Rule or Part 500, and building to it satisfies the vaguer regimes too.
• Pick one framework and crosswalk to it. Run the program on NIST CSF 2.0 or the CIS Controls and maintain a mapping from each legal requirement to the control that satisfies it. When a regulator asks how you meet § 314.4(c)(5), you want to answer with a control number and evidence, not a narrative.
• Write down risk acceptance. No company fixes everything. The defensible position is a risk register in which every known gap is either remediated on a schedule or formally accepted, in writing, by someone with authority to accept it. Undocumented acceptance looks like neglect.
• Make the board's oversight visible. Written reports at least annually (the Safeguards Rule and Part 500 require it), committee minutes that record questions as well as presentations, and a record of resources requested and granted.
• Edit your public statements. Every security claim on the website, in the privacy policy, in sales materials, and in SEC filings should be checked against reality by someone who knows both. "Bank-level," "military-grade," and "we never share your data" are where deception cases start. See Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC.

For the company under investigation

Regulators usually start with a letter or a civil investigative demand after a breach. Preserve everything immediately, including chat channels, and issue a hold. Assemble a timeline before answering questions, because the agency will build its own from your documents. Be accurate rather than fast in public statements: Blackbaud's problem with both the SEC and the FTC was early statements that turned out to be wrong. When negotiating an order, focus on the definitions (what counts as "covered information" and "covered incident"), the duration, the assessor's independence and scope, and which affiliates are bound. Litigating against the FTC is possible, as LabMD showed, but it took LabMD years, and the company did not survive to enjoy the win.

For regulators, plaintiffs, and whistleblowers

The best evidence is almost always internal: penetration test reports with unremediated findings, risk registers, audit letters, prior incidents, and emails from security staff warning management. Discovery fights focus on forensic reports, and privilege over them is far from automatic. Courts have ordered production where the forensic firm's work served business purposes or was arranged under a pre-existing contract (for example, In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020)), while protecting work that was genuinely directed by counsel in anticipation of litigation under Fed. R. Civ. P. 26(b)(3). Plaintiffs plead the Safeguards Rule, Part 500, and NIST as the standard of care, and they use the company's own Item 106 disclosures and website statements as the yardstick for what it promised. In government contracting, the False Claims Act's qui tam provisions, 31 U.S.C. § 3730, give insiders a share of any recovery, and many cyber-fraud cases begin with a security employee.

For the defense in litigation

Defendants win on standing (especially in the Fourth and Eleventh Circuits), on causation (data elements that do not enable the alleged fraud, or plaintiffs whose data was in several breaches), on the economic loss rule in states that apply it strictly, and, in securities cases, on the gap between general statements and specific promises. In derivative cases, the defense is the record: if the board received regular reports and acted on them, Caremark claims rarely survive. The defense is weakest where the plaintiffs have a document showing a known, unfixed weakness.

For individuals whose data is at risk

Ordinary people have fewer direct remedies than the volume of law suggests. Most of these regimes are enforced by agencies, not individuals. A consumer can complain to the FTC or the state attorney general, freeze credit at the three bureaus (free by federal law), and, if the data was California residents' data covered by § 1798.150, join or bring a claim for statutory damages. Employees whose employer leaked their data may have a negligence claim in states like Pennsylvania. For practical steps after a breach, see Identity Theft and Credit Reporting: FCRA Rights, Disputes, and Remedies.

Costs and practical realities

• Program costs scale with complexity, not headcount. A fractional or "virtual" CISO commonly costs a few thousand to a few tens of thousands of dollars a month. An external penetration test of a modest environment often runs in the low tens of thousands of dollars. A first SOC 2 Type II audit, with readiness work, can cost a mid-size company well into six figures. Managed detection and response is priced per endpoint or per user. These figures vary widely by market and scope; get quotes.
• Enforcement costs are mostly the order's afterlife. A twenty-year FTC order with biennial outside assessments costs far more over its life than most settlements. NYDFS penalties have reached seven and eight figures, and the remediation the Department requires costs more.
• Breaches are expensive regardless of regulation. IBM's widely cited 2024 Cost of a Data Breach study put the average global breach at about $4.9 million, and the U.S. average at more than twice that. Detection and escalation, lost business, and notification dominate the cost.
• Insurance shapes the program. Cyber insurers now condition coverage on MFA, endpoint detection, offline or immutable backups, and training, and they ask about each on the application. A misstatement can void coverage: at least one insurer obtained rescission of a policy after a ransomware attack revealed that the MFA described in the application protected only part of the network. Treat the application like a sworn statement. See Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.
• Vendors are where the incidents are. The 2023 MOVEit file-transfer campaign hit thousands of organizations through one vendor's software, and the 2024 Change Healthcare ransomware attack began, according to its parent company's testimony to Congress, through a remote-access portal that lacked MFA. Every regime above makes vendor oversight the customer's responsibility. See Building a Vendor and Third-Party Risk Management Program.
• Time is the scarce resource. Building a compliant program from a low base usually takes six to eighteen months. The clocks after an incident run in hours and days.

Common mistakes

1. "We're not a financial institution." Auto dealers, tax preparers, mortgage brokers, collection agencies, and many fintechs are, and so are colleges that participate in federal student aid programs, which must comply with the Safeguards Rule as a condition of participation.
2. A risk assessment that is a template. Regulators can tell. The assessment must describe your systems, your data, and your threats, and it must lead to decisions.
3. MFA with exceptions nobody tracks. Service accounts, legacy VPN appliances, vendor support portals, and executives who complained. The exceptions are where attackers get in, and the Safeguards Rule and Part 500 require any exception to be approved in writing.
4. Marketing writes the security page. Every specific claim is a representation to consumers, business customers, and, for public companies, investors.
5. Findings without owners. A penetration test finding that sits open for a year, with no risk acceptance, is the plaintiff's best exhibit.
6. Oral board reporting. If it is not in the minutes, it did not happen for Caremark purposes.
7. Keeping everything. Data the company does not need is pure liability, and since Drizly and Blackbaud, over-retention is itself an FTC violation theory.
8. An incident response plan that has never been exercised. Tabletop exercises reveal who has authority to make the materiality call, who calls the insurer, and who knows the regulator's portal password.
9. Waiting for forensics to decide materiality. The SEC requires the determination "without unreasonable delay," not certainty.
10. Overconfident breach notices. "No evidence of misuse" and "no sensitive data was involved" are statements that later facts tend to contradict.

Worked example: a regional auto dealer group discovers it is a financial institution

The facts. Harbor Point Auto Group owns nine dealerships in Massachusetts, New Hampshire, and Rhode Island and employs about 450 people. Its finance and insurance (F&I) offices arrange financing through two dozen banks and captive lenders and write leases of 24 to 48 months. It keeps about 60,000 customer files: credit applications with Social Security numbers, income, and bank account details; copies of driver's licenses; and paper "deal jackets" in each store's back office. Its dealer management system (DMS) is hosted by a software vendor; a local managed service provider (MSP) runs email and the network; one IT manager handles everything else. In 2024 a lender's audit questionnaire asked for the name of Harbor Point's "Qualified Individual." No one knew what that meant.

Step 1: coverage. Harbor Point arranges credit and leases vehicles for more than 90 days, so it is a financial institution under the Safeguards Rule for that business. 16 C.F.R. Part 314. It is outside the CFPB's authority, so the FTC is its federal security regulator. It holds customer information on far more than 5,000 consumers, so no element is excused. Cash buyers are not GLBA "customers," but Massachusetts' 201 CMR 17.00 covers their personal information anyway, and Section 5 of the FTC Act covers everything. As a creditor, Harbor Point also needs an identity theft program under the Red Flags Rule, and as a user of credit reports it must follow the Disposal Rule.

Step 2: the Qualified Individual. The IT manager is capable but has no security training and no authority over store managers. Harbor Point contracts with a virtual CISO through a security firm (not the MSP, to avoid the MSP auditing itself), designates its chief operating officer as the senior person responsible for directing and overseeing the vCISO, and writes into the contract that the firm maintains a program protecting Harbor Point as § 314.4(a) requires.

Step 3: the written risk assessment. The vCISO inventories systems and data and identifies the real risks: phishing aimed at F&I managers, whose mailboxes are full of credit applications; shared logins on F&I desk computers; the DMS vendor's remote support access; a lender portal used with one password per store; unencrypted laptops used at off-site sales events; guest Wi-Fi on the same network as the showroom computers; and boxes of deal jackets going back to 2012. Each risk is rated and assigned a treatment, and the assessment states the criteria used, as § 314.4(b)(1) requires.

Step 4: controls. MFA on email, the DMS, the VPN, and every lender portal; individual logins with role-based access, so salespeople no longer see full credit applications; full-disk encryption on laptops and confirmation that the DMS vendor encrypts data at rest; network segmentation separating guest Wi-Fi; logging of DMS access with alerts for bulk exports; security awareness training with phishing simulations; and a change management procedure for the DMS.

Step 5: retention and disposal. The rule requires disposal of customer information no later than two years after it was last used for the customer unless retention is needed for a legitimate business purpose or required by law. Harbor Point's counsel builds a schedule that respects other retention laws (for example, Regulation B's 25-month retention period for credit application records, 12 C.F.R. § 1002.12, and tax and title record rules) and then shreds about forty boxes of deal jackets under a documented process.

Step 6: vendors, testing, the plan, and the board. Harbor Point collects SOC 2 reports from the DMS and CRM vendors, adds security and 72-hour notice terms to the MSP contract, and sets up a vendor inventory. It schedules an annual external penetration test and quarterly vulnerability scans. It writes an incident response plan that includes the FTC notice, the state breach laws, its insurer, and law enforcement. The vCISO delivers a written report to the owners' board in December, and the minutes record the board's questions and its approval of the budget.

Then it happens. In March, an F&I manager at the Providence store clicks a fake "lender funding notice," and the attacker sets a rule forwarding his mail to an outside address. The manager notices strange replies on a Friday and tells the IT manager. That Friday is the discovery date, because knowledge of any employee other than the attacker is imputed to the company. 16 C.F.R. § 314.4(j)(2). The logs show that 1,140 customers' credit applications were attached to forwarded messages. That is unencrypted customer information acquired without authorization, involving more than 500 consumers, so Harbor Point must notify the FTC within 30 days of that Friday. The Massachusetts, New Hampshire, and Rhode Island breach statutes have their own notice duties and deadlines, and Massachusetts requires at least 18 months of free credit monitoring where Social Security numbers were exposed.

What made the difference. Because MFA had been turned on in January for everything except one legacy mailbox setting the MSP had missed, the attacker got only the forwarded mail, not the DMS. Because logging existed, Harbor Point could prove the number was 1,140 and not 60,000. And because the program, the risk assessment, and the board report existed in writing, the FTC's follow-up questions had answers. The missed setting is now a documented finding with an owner and a closed date.

Worked example: a public SaaS company decides whether a ransomware attack is material

The facts. Northwind Ledger, Inc. is a Nasdaq-listed payroll and workforce software company with about $600 million in annual revenue and 4,000 mid-market employer customers. Its 10-K says its audit committee oversees cybersecurity risk and receives quarterly reports from the CISO. A subsidiary holds a New York money transmitter license for an earned-wage-access product, which makes that subsidiary a covered entity under Part 500.

Monday, 2:10 a.m. Endpoint detection alerts fire, and by 4:00 a.m. ransomware has encrypted servers supporting Northwind's time-and-attendance module, which produces about 15 percent of revenue. A ransom note claims 1.2 terabytes of stolen data and demands $8 million in cryptocurrency.

Monday morning. The incident response plan activates. Outside counsel retains a forensic firm under a new engagement letter, the cyber insurer is notified (its policy has a $25 million limit and requires consent before any ransom payment), and the FBI is contacted. The general counsel convenes the disclosure committee and closes the trading window for everyone with knowledge of the attack; in 2018 the SEC and federal prosecutors charged a former Equifax executive who sold stock after learning of that company's breach.

Tuesday. Forensics confirm that the attacker exfiltrated a database containing payroll records of about 2.3 million of Northwind's customers' employees, including Social Security numbers and bank account numbers. Restoration of the module will take about ten days.

The materiality analysis. The disclosure committee works through the factors the SEC identified, applying Basic's probability-and-magnitude approach to an event still unfolding:

• Quantitative: service credits owed under customer contracts; lost revenue during the outage; forensic, legal, notification, and credit monitoring costs; and the ransom demand. Even before insurance, the likely costs are a meaningful share of quarterly earnings.
• Qualitative: exfiltration of the most sensitive categories of data; a near-certain wave of class actions; inquiries from state attorneys general and the FTC; customers' own notification duties to their employees, which will make the incident public within weeks; and the risk that customers move to competitors in the next renewal cycle.
• Context: Northwind's Item 106 disclosure tells investors that its processes are designed to protect exactly this data.

On Wednesday the committee, with the audit committee's concurrence, determines that the incident is material. The Item 1.05 Form 8-K is due within four business days, by the following Tuesday. The company does not wait for the forensic firm's final report.

What the 8-K says. It describes the nature, scope, and timing of the attack; states that data including Social Security and bank account numbers of customers' employees was exfiltrated; says the time-and-attendance module is unavailable and the company expects restoration within about two weeks; and says the company has not yet determined the full financial impact, which it will report by amendment. It avoids technical details that would help the attacker, and it avoids words the facts may not support, such as "limited," "contained," or "no evidence of misuse."

The other clocks running in parallel. Ransomware was deployed in a material part of the New York subsidiary's systems, so the subsidiary must notify NYDFS within 72 hours of determining that a cybersecurity incident occurred. If Northwind pays any ransom, the subsidiary must give NYDFS notice within 24 hours and a written justification within 30 days, and Northwind must first screen the threat actor against OFAC's sanctions lists and document that diligence. Northwind's customer contracts require notice to customers within 72 hours. The customers, as the owners of their employees' data, will decide on and send most individual notices, and many will demand that Northwind pay for them.

The counterfactual. Suppose instead that the ransomware had hit an isolated test environment with synthetic data, and that systems were restored in four hours from immutable backups. That incident is very likely not material. Northwind would not file under Item 1.05; if the attack became public, it could describe it under Item 8.01. It would still document the analysis in a materiality memo, because if later facts showed exfiltration, the SEC would ask when the company should have known.

What the board does next. The audit committee holds two special meetings, minuted, receives written briefings, and asks for an independent post-incident review. That record is the company's best defense in the derivative suit that will follow, and it is what Item 106 promised investors would happen. For the disclosure mechanics, see Running a Public Company Disclosure Program: A Practical Guide.

Frequently asked questions

We are a small business. Do any of these rules really apply to us? Almost certainly at least one does. Section 5 of the FTC Act applies to nearly every for-profit business, Massachusetts' regulation applies to anyone holding a Massachusetts resident's personal information, and the Safeguards Rule applies to small tax preparers, mortgage brokers, and car dealers. The rules scale: the Safeguards Rule excuses institutions with fewer than 5,000 consumers from four elements, and Part 500 has a limited exemption. But "small" is not "exempt."

Is there one federal law that requires reasonable security for every business? No. The closest thing is the FTC's use of Section 5, confirmed in Wyndham. Congress has considered general data security legislation many times without passing it.

What is the difference between the NYDFS 72-hour notice and the SEC's four-business-day 8-K? Different triggers and audiences. NYDFS wants notice within 72 hours after the company determines that a "cybersecurity incident" occurred, which includes any ransomware deployment in a material part of its systems, whether or not investors would care. The SEC wants an 8-K within four business days after the company determines the incident is material to investors. A ransomware attack on a public company with a New York license can trigger both, on different days, with different content.

If we paid the ransom and got our systems back, do we still have to disclose? Possibly. Paying or restoring does not make an incident immaterial if data was stolen, operations were disrupted, or litigation and regulatory inquiries are reasonably likely. Paying also creates its own obligations: OFAC diligence, NYDFS's 24-hour and 30-day extortion payment notices for covered entities, and, once CISA's rule takes effect, a 24-hour CIRCIA report.

Can directors or executives be personally liable for a breach? Directors face derivative claims under Caremark, which have so far been dismissed where the board had a reporting system and used it. Executives face more direct exposure: the FTC named Drizly's CEO in its order, Part 500 requires the CEO and CISO to sign the annual certification, the SEC charged SolarWinds' CISO personally, and a federal jury convicted Uber's former chief security officer in 2022 of obstructing an FTC investigation and concealing a breach.

Which framework should we adopt? The one that fits your regulators and customers. Defense contractors need NIST SP 800-171. Companies that sell to enterprises often need SOC 2 or ISO/IEC 27001 because customers demand them. For most others, NIST CSF 2.0 with the CIS Controls as the implementation layer is a sound default, and it qualifies for the state safe harbors in Ohio and elsewhere.

Is our risk assessment privileged? Usually not. A risk assessment the law requires you to perform is a business record. Legal advice about it can be privileged, and a separate assessment commissioned by counsel to advise on litigation or regulatory exposure may be protected, but the required assessment itself should be written on the assumption that a regulator or plaintiff will read it. See Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest.

If we follow NIST, are we safe? Safer, not safe. A framework shows that the program was designed reasonably. It does not prove that the controls worked or that the company fixed what its own assessments found. In a handful of states, documented conformity is an affirmative defense to tort claims.

Practical takeaways

• The duty to secure data is real, layered, and mostly enforced by agencies. Map every regime that applies before building anything.
• Build to the most prescriptive rule that applies (often the Safeguards Rule or Part 500) and crosswalk everything else to it.
• The documents are the program: the written risk assessment, the WISP, the risk register with documented acceptances, the incident response plan, the vendor files, and the board reports.
• Put MFA on every door, encrypt sensitive data, log access, segment networks, test on schedule, and delete what you do not need.
• Name the accountable people, give them authority, and get their reports into the board minutes.
• Treat every public security statement as testimony, because the FTC, the SEC, and plaintiffs will.
• Know the clocks before you need them: 24 and 72 hours (NYDFS), 36 hours (banks), 72 hours (DFARS), four business days after a materiality determination (SEC), 30 days (FTC Safeguards Rule, Regulation S-P), 60 days (HIPAA and the Health Breach Notification Rule).
• Decide materiality promptly and document the reasoning, and never pay a ransom without sanctions diligence.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Companion documents in this series

• Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide: the step-by-step program build, from scoping and the risk assessment to board reporting and examination readiness.
• Cybersecurity Regulatory Compliance Checklist: A Practical Checklist: an item-by-item checklist keyed to the FTC, Safeguards Rule, NYDFS, SEC, HIPAA, and state requirements.
• Cybersecurity Compliance Toolkit: Written Information Security Programs, Risk Assessments, and Incident Disclosure Memos: templates for the WISP, the risk assessment, board reports, and the materiality memo.

Related Articles

• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: the notification side of the same problem.
• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: how to make security and privacy statements that will not become deception claims.
• Connected Device Security and Software Liability: Regulators, Standards, and the Duty to Patch: the product-security counterpart to enterprise security duties.
• Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice: how coverage responds to breaches and the claims that follow.
• HIPAA Privacy and Security Compliance for Covered Entities and Business Associates: the health care regime in depth.
• Fiduciary Duties of Directors and Officers: The Business Judgment Rule, Loyalty, and Caremark Oversight: the oversight duty behind cyber derivative suits.
• Securities Fraud Litigation Under Rule 10b-5: Elements, the PSLRA, and Defense Strategy: the private-litigation exposure for cyber disclosures.
• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: the state privacy statutes and their security duties.
• False Claims Act Qui Tam Litigation: The Seal, Materiality, Scienter, and Government Intervention: the enforcement engine behind cyber-fraud cases against contractors.
• Export Controls and Economic Sanctions: The EAR, ITAR, and OFAC for Ordinary Businesses: the sanctions rules that govern ransom payments.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the standing doctrine that decides which breach suits proceed.
• Expert Depositions: Taking Apart the Opinion, Protecting Your Own Expert, and Building the Daubert Record: useful when "reasonable security" becomes a battle of experts.

Related Guides

• Responding to a Data Breach: The First Seventy-Two Hours: the response sequence once an incident is confirmed.
• Building a Vendor and Third-Party Risk Management Program: the vendor oversight every regime requires.
• Running a Public Company Disclosure Program: A Practical Guide: disclosure committees, controls, and 8-K practice.
• Data Minimization and Avoiding the Over-Retention of Personal Information: retention schedules that satisfy the FTC's minimization demands.
• Drafting and Maintaining a Privacy Policy: A Practical Guide: keeping public statements aligned with actual practice.

Related Checklists

• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: assessing and contracting with vendors that touch your data.
• HIPAA Security Rule Risk Analysis Checklist: A Practical Checklist: the risk analysis OCR expects.
• Disclosure Controls and Insider Trading Checklist: A Practical Checklist: controls that carry incident information to the people who disclose it.
• D&O and Cyber Insurance Review Checklist: reviewing the policies before the incident.

Related Toolkits

• Cybersecurity Program Toolkit: a stage-by-stage roadmap for the technical program.
• Data Breach and Incident Response Toolkit: From Detection to Notification: templates for the response itself.
• Executive and Cyber Coverage Toolkit: Policy Comparisons, Notice Letters, and Allocation Analyses: insurance notice and coverage tools.
• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: templates for the public statements regulators test.