2. The State of Cybersecurity and
Worst Case Scenario
The State of Cybersecurity and
Lessons Learned
2016 ACC Mid-Year Meeting

3. Program Agenda Highlights from the State of Cybersecurity Report
Managing risk, privilege and the investigation process
Best practices for information sharing and working with regulators
Incident response planning and what to do now
Who should be on your go-to list
Cybersecurity insurance and why most organizations don’t have enough
Mistakes to avoid when communicating with the media

4. Speakers
Charles Kallenbach, Chief Legal Officer and General Counsel, Heartland Payment Systems Edward J. McAndrew, Partner, Ballard Spahr LLP Stewart A. Pomerantz, Senior Vice President & Associated General Counsel, Jefferies LLC Phil N. Yanella, Partner, Ballard Spahr LLP

5. Why the ACC Foundation Conducted This Important Study
Cybersecurity is a leading concern among in-house counsel
Expanding role of in-house counsel
53% allocating more of their budget to cybersecurity

6. About the Report Data breaches by industry and region
Top cybersecurity causes and concerns worldwide
Company and legal department budgets
Cybersecurity insurance
Lessons learned
Managing vendors and outside risk
Detailed glossary of information security terms
Self assessment tool for benchmarking
And much more………..

7. How Would You Characterize Your
Responsibilities Regarding Cybersecurity in Your Company?

8. in-house counsel experienced a data breach
31% of
in-house counsel experienced a data breach

9. Most GC/CLOs and other in-house counsel do not know what standards their organization uses to address cybersecurity

10. Member of the Legal Department on a Data Breach Team?

11. How Was the System Breached?

12. Ranking of Immediate Concerns Related to Data Breach

13. Mandatory Cybersecurity Training for All Employees

14. How Does Your Organization Evaluate Company
Preparedness at the Employee Level?

15. Portion of law department’s budget specifically dedicated to cybersecurity or related cyber issues

17. The Legal and Regulatory Landscape
Class action litigation
Consumer Financial Protection Bureau (CFPB)
Cybersecurity Information Sharing Act (CISA)
European Union (EU)
Federal Trade Commission
UK Financial Conduct Authority (FCA)
US Securities & Exchange Commission (SEC)

18. What challenges did you face in preserving lawyer-client privilege after the data breach, and how did you navigate these?

19. Less than half of the respondents say their company has cybersecurity insurance

20. Did Insurance Cover the Damages Incurred From the Breach?

21. General Counsel and Lessons Learned
“No firewall can give 100% protection” “How much time is involved in responding to a breach” “Act fast and get out ahead of the news and the regulators” “Some employees working from home are on their own unencrypted devices”

22. Crisis Management Dos Prepare a three-tiered incident response plan
Test the plan quarterly for vulnerabilities
Identify a centralized decision maker (in legal)
Join an industry based ISAC (Information sharing and analysis center)
Select and media train a spokesperson
Stay ahead of the news curve

23. Crisis Management Don’ts
Assume cybersecurity is an IT issue
Provide lost record numbers and breach details to media prematurely
Rely on text book incident response plans
Limit response to only US state law or other regulatory notification requirements
Select and media train a spokesperson

24. What Resource Was Most Helpful?
An outside call center
In-house privacy counsel
Having an established incident response team
Chief privacy officer and local law enforcement
Subject matter experts and a single center point of contact
Retaining outside counsel and experts
Office of Australian Information Commissioner Guidelines

25. “Act as if you’ve already been breached”

26. For addition information:
Derede McAlpin
ACC, Vice President & Chief Communications Officer
ACC FOUNDATION: THE STATE OF CYBERSECURITY REPORT
Price:
Members - $475
Non-Members - $595
Underwritten by: