Law.com Subscribers SAVE 30%
Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.
<b><i>Breaking News:</b></i> Much Ado About 'Minimum Standards' for DFS Cybersecurity Regulation
Editor's Note: On Sept. 13, 2016, New York Governor Andrew Cuomo announced New York State Department of Financial Services Proposed 23 NYCRR 500 'Cybersecurity Requirements for Financial Services Companies.' The proposed regulation were published on Sept. 28, and this article has been'updated with any changes made after the draft release in conjunction with Mayor Cuomo's announcement.'
The New York State Department of Financial Services (DFS) made headlines on September 13 by announcing a 'first-in-the-nation,' comprehensive cybersecurity regulation, which will mandate 16 'minimum standards' for the 4,000+ institutions operating under DFS jurisdiction. From a practical perspective, the proposed regulation adopts or aligns with guidance from the 2014 National Institute of Standards and Technology (NIST) Framework, portions of the Fair Trade Commission's 2015 Start with Security program, as well as the basic requirements that banks have established and enforced for their third party vendors for several years. In short, there is nothing revolutionary or innovative in the proposed regulation. Indeed, the DFS acknowledges that 'many firms have proactively increased their cybersecurity programs with great success,' and its own 2013 survey found that 90% of institutions (and 98% of large institutions) had implemented a comprehensive information security framework. Notwithstanding sensational headlines, a review of the volume of significant breaches at financial institutions over the last decade supports the conclusion that financial institutions are taking cybersecurity extremely seriously; large data breaches occur less and less frequently, and the root cause seldom is poor security. All of this begs the questions ' why the need for New York's proposed regulation, and what will be the practical impact for financial and other institutions across the country?
The DOJ's Corporate Enforcement Policy: One Year Later
The DOJ's Criminal Division issued three declinations since the issuance of the revised CEP a year ago. Review of these cases gives insight into DOJ's implementation of the new policy in practice.
The DOJ's New Parameters for Evaluating Corporate Compliance Programs
The parameters set forth in the DOJ's memorandum have implications not only for the government's evaluation of compliance programs in the context of criminal charging decisions, but also for how defense counsel structure their conference-room advocacy seeking declinations or lesser sanctions in both criminal and civil investigations.
Use of Deferred Prosecution Agreements In White Collar Investigations
This article discusses the practical and policy reasons for the use of DPAs and NPAs in white-collar criminal investigations, and considers the NDAA's new reporting provision and its relationship with other efforts to enhance transparency in DOJ decision-making.
Bankruptcy Sales: Finding a Diamond In the Rough
There is no efficient market for the sale of bankruptcy assets. Inefficient markets yield a transactional drag, potentially dampening the ability of debtors and trustees to maximize value for creditors. This article identifies ways in which investors may more easily discover bankruptcy asset sales.
A Lawyer's System for Active Reading
Active reading comprises many daily tasks lawyers engage in, including highlighting, annotating, note taking, comparing and searching texts. It demands more than flipping or turning pages.