Our assessments identify gaps in organizations’ critical risk areas and include recommendations on how to close them. This includes vendor and contract review, transactional due diligence, evaluating cyber insurance policies, and counseling upper management and board members on the scope of the risk and need for affirmative action.

We identify applicable industry-specific and jurisdictional laws, regulations and standards regarding personal and protected data to help ensure regulatory compliance. We conduct an in-depth analysis of our clients’ current security programs, including interviews with key stakeholders, to identify vulnerabilities and establish a cyber risk profile. We help clients prioritize high-risk scenarios for security prioritization through such methods as tabletop exercises to evaluate incident response and business continuity plans, and stakeholder meetings to identify and protect critical systems and vendors.

Clients can expect a detailed cyber risk report with strategic recommendations for developing and/or enhancing information security programs and policies to help ensure regulatory compliance and proactive risk management and assistance with drafting policies and implementing training that addresses the identified weaknesses.

Harris Beach Murtha’s Cybersecurity Protection and Response Practice Group helps organizations from all industry sectors implement data privacy and security policies that comply with state and federal data privacy laws.

Today, nearly every state has some form of privacy requirement and required notice provision before an organization can collect or use certain types of identifiable information. Harris Beach Murtha has helped organizations from all industry sectors to implement data privacy and security programs that comply and harmonize these different state laws.

We also work with our multinational clients to reconcile some of the legal tensions created when two nations have conflicting privacy laws. This can be accomplished either through contracts or, with the help of our technical consultants, we implement controls that protect the organization’s use of each nation’s data when the laws simply do not allow for compromise.

Our work also includes developing web privacy policies that balance the reporting and disclosure requirements with the flexibility to effectively use data collected from future data subjects – especially important for companies that may merge with other organizations or be sold or acquired.

Our work includes in-depth examination or creation of policies to ensure they comply with National Institute of Standards and Technology Protocols, General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) requirements, Sarbanes-Oxley Act (SOX) requirements, Gramm Leach Bliley obligations and requirements from the Office of Civil Rights, the Federal Trade Commission, State Attorneys General and Federal Communications Commission.

Our team responds quickly upon notification of an actual or suspected breach. Our attorneys and IT professionals coordinate a thorough response under the protection of attorney-client privilege. We help identify and contain the risk, identify the scope of the breach through forensic investigations, provide tactical recommendations to prevent additional incidents, and identify vulnerable records containing personally identifiable information (PII) and/or protected health information (PHI). Even if an organization has cyber insurance, our trusted attorneys help you get through those critical initial few hours while the insurance process unfolds, and we often continue to represent you once insurance engages.

In the event data is illegally acquired, we provide guidance on notifying affected individuals and consult on when and how to cooperate with regulatory agencies and/or law enforcement during an investigation. We provide strategic recommendations for preventing similar incidents from recurring and confirm the necessary steps are taken to ensure appropriate insurance coverage.

Our cybersecurity team has experience handling high-stakes class action lawsuits, government investigations and regulatory enforcement actions. We represent and defend clients in all aspects of litigation and regulatory investigations arising from data breaches and alleged violations of data privacy requirements – from pretrial and investigative phases through trial and appeal.

We provide pretrial guidance, including evaluating potential claims and liability risks, as well as assessing options for alternative dispute resolution. Our team will tailor innovative, practical and cost-effective solutions for the unique challenges of each matter.

Managing a breach is critical. Investors, customers and regulators are watching. Harris Beach Murtha’s pre-breach communications planning services help clients position themselves to mitigate the potentially damaging repercussions of a data breach, and, in the event of a breach, we help you manage message points, put the controversy behind you, and preserve your image, brand and internal morale.

Our in-house communications team works with our clients’ communications and public relations professionals to develop or enhance communications management plans with cybersecurity components. We also develop channel and stakeholder-specific communications. We identify and train internal communications people to respond to the media or we act as third-party spokespeople on their behalf. We also conduct media outreach and monitor the response, including on social media.