October 17, 2019

October 17, 2019

Subscribe to Latest Legal News and Analysis

October 16, 2019

Subscribe to Latest Legal News and Analysis

October 15, 2019

Subscribe to Latest Legal News and Analysis

Will Cybersecurity Best Practices Morph into Cyber Mandates?

The federal government has been encouraging employers to adopt best practices to address both external and internal threats to critical business information and infrastructure. These best practices have included an important human resources element, including policies and programs covering current and former employees.

For example, the Obama Administration opened its initiative to combat trade secret theft with a report that listed human resources policies as one of four areas in which employers need to adopt best practices. Similarly, the Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology and the recently published Best Practices for Victim Response and Reporting of Cyber Incidents developed by the U.S. Department of Justice include multiple recommendations regarding human resources policies needed to manage cybersecurity risks. Employees can be among the best protectors of employers’ critical information, or its worst threat.

In a new development, some U.S. state governments are beginning to mandate human resources policies to address these threats. For now, the mandates extend to only to a limited range of policies—such as mandatory employee training and disciplinary measures—and apply only to certain industries, such as government contractors and health insurance entities (a category, by the way, that includes health insurers, health care centers, pharmacy benefits managers, third-party administrators, and utilization review companies).

It’s not hard to imagine these mandates expanding to cover more industries in more jurisdictions and a broader range of policies and procedures. Consider, for example, the impact a mandate might have that requires the clawback of compensation and benefits from executives for certain breaches of their cybersecurity obligations.

© 2019 Covington & Burling LLP


About this Author

Richard Shea, employee benefits attorney, Covington

Richard Shea is chair of Covington’s Employee Benefits and Executive Compensation practice. Mr. Shea is widely regarded as the nation’s leading authority on cash balance, pension equity, and other complex benefit plan designs. His practice spans the full breadth of activities needed to help his clients resolve novel, sensitive, or intractable issues. His approach focuses on developing important new legal insights and ideas, and then combining them into effective litigation, legislative, regulatory, and benefit design strategies for his clients. The representative matters...

William Woolston, Covington, Employee benefits lawyer

Will Woolston helps employers solve tough employee benefits and executive compensation problems. Mr. Woolston is a partner in the firm’s Washington office whose practice focuses on all aspects of employee benefits and executive compensation for companies in a variety of industries, including specialty chemicals and performance materials, defense and aerospace, gaming and entertainment, water technologies, sports, and telecommunications. Mr. Woolston advises enterprises of all sizes, from large Fortune 50 multinationals to start-ups and private equity portfolio companies.

Mr. Woolston offers a practical approach to employers facing challenging decisions and transactions that impact their officers, executives, employees, and retirees. His approach and perspective developed over many years of close, day-to-day relationships with counsel and staff at major multinationals. In addition, Mr. Woolston offers an insider's view and appreciation of the challenges facing in-house counsel, having once served as seconded corporate counsel to one of the largest U.S. defense contractors.

Ashden Fein, Litigation attorney, Covington Burling

Ashden Fein advises clients on cybersecurity and national security matters, including government and internal investigations, regulatory, and complex litigation matters.

For cybersecurity matters, Mr. Fein specifically counsels clients on preparing for and responding to cyber-based attacks, assessing their security controls and practices for the protection of data and systems, developing and implementing cybersecurity programs, and complying with federal and state regulatory requirements. Mr. Fein also has been the lead investigator and crisis manager for multiple...