SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP & AFFILIATES PRIVACY AND CYBERSECURITY AUDITS

Size: px

Start display at page:

Download "SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP & AFFILIATES PRIVACY AND CYBERSECURITY AUDITS"

Robert McKenzie
7 years ago
Views:

1 SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP & AFFILIATES PRIVACY AND CYBERSECURITY AUDITS

2 PRIVACY AND CYBERSECURITY AUDITS There are numerous technology-based steps that companies can take today to prevent a cyber attack or at least minimize the impact if an attack occurs. However, a company s privacy and cyber-preparedness cannot end there. Most litigation, whether by the FTC, state attorneys general, or private class action lawyers, focus on allegedly false or misleading statements that the company made to customers, investors or even their own employees abou-t privacy or cybersecurity. In many cases, plaintiffs also attack a company for failing to have appropriate privacy and cybersecurity governance structure in place, including a failure to keep C-suite executives or the board properly apprised of these critical issues. As a result, companies today essentially need to build a legal firewall that will help insulate them from these claims. Skadden s Privacy and Cybersecurity Group has the expertise and experience to audit a company s privacy and cybersecurity practices, polices, and governance structures and to suggest a best practices approach based on what we have seen across scores of clients and industries. These audits are performed in a cost effective manner through document reviews and internal interviews. Companies emerge from these audits better protected against potential claims. In addition, such audits typically help engender a culture of vigilance with respect to privacy and cybersecurity that has benefi ts that extend beyond the audit itself. A privacy and cybersecurity audit generally includes the following steps, although it is highly customized depending on the client s needs and the type of information it controls. PRIVACY Ensure the company collects personally identifi able information ( PII ) data in a manner that complies with applicable legal requirements and disclosures that were made to individuals. Suggest modifi cations to practices or policies to ensure consistency between disclosures and actual practice. Ensure the company is in compliance with any data use restrictions imposed by third parties, including social media platforms. Establish internal processes to ensure that PII always is used in a manner that complies with applicable legal requirements and external and internal disclosures. Establish a data map of how information is collected, used, managed, stored and distributed internally and externally that can be updated and monitored on a regular basis. Establish a process for ensuring local law compliance and, outside the U.S., for interacting with applicable data protection authorities. Establish ongoing training and monitoring programs. Review and/or create all necessary policies and procedures. 2

3 PRIVACY AND CYBERSECURITY AUDITS CYBERSECURITY Review and/or create internal policies and procedures to ensure that employees are aware of their cybersecurity obligations and that the company is not making internal statements that could expose the company to liability. Review all external statements regarding the state of the company s cybersecurity to ensure the company is not making external assurances that could expose the company to liability. Review third-party agreements to determine whether minimum cybersecurity requirements is included. Where necessary, develop language to include in all third-party agreements regarding minimum cybersecurity requirements and establish governance procedures for ensuring that such language is included. Review and, where necessary, help the company establish internal governance procedures regarding cybersecurity, including upward reporting to the C-suite and to the board, as well as audit processes to monitor ongoing compliance. Review and/or establish a cyber attack rapid response plan. Please see our separate materials on this capability. Advice regarding cybersecurity insurance coverage. POLICIES AND PROCEDURES The Skadden Privacy and Cybersecurity Group has experience creating and reviewing each of the following types of policies and procedures: External facing privacy policies; Internal policies guiding the use of PII and cybersecurity; Statements to be used in marketing collateral regarding privacy and security policies; Infosec policy; Rapid response plan in the event of a data breach or cybersecurity incident; Transborder data fl ow documentation (e.g., model contracts, Safe Harbor certifi cation, etc.); and Language regarding privacy and cybersecurity to include in applicable third-party contracts. 3

Cybersecurity T: 212.735.2750 E: stuart.levi@skadden.com James S.

4 SKADDEN CONTACTS Stuart D. Levi Partner / New York Intellectual Property and Technology, Privacy and Cybersecurity T: E: stuart.levi@skadden.com James S. Talbot Counsel / New York Intellectual Property and Technology, Privacy and Cybersecurity T: E: james.talbot@skadden.com 4

5 Beijing Houston Palo Alto Sydney Boston London Paris Tokyo Brussels Los Angeles São Paulo Toronto Chicago Moscow Seoul Washington, D.C. Frankfurt Munich Shanghai Wilmington Hong Kong New York Singapore

6 SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP & AFFILIATES

Privacy and Cybersecurity Compliance, Preparedness and Rapid Response

Privacy and Cybersecurity Compliance, Preparedness and Rapid Response Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates The Americas Boston Chicago Houston Los Angeles New York Palo Alto São Paulo