Security governance
Review policy commitments, oversight and evidence supporting the security decisions your business is making.
03 / CYBERSECURITY
Prepare the business.
Clarify the response.
Legal support for security governance, vendor obligations and incident readiness.
Discuss a matterVendor & contract review
Examine security assurances, incident-notice duties, allocation of responsibilities and the limits of supplier evidence.
Incident readiness
Clarify escalation, preservation and notification decision processes before an incident. Develop an agreed scope for tabletop or readiness work.
A QUESTION WORTH ASKING
A supplier reports an incident. Who gathers the facts, preserves the record and decides which contractual or legal notifications may be required?
Illustrative scenario, not a description of a client matter.
QUESTIONS BUSINESSES ASK
Start with a clearer
understanding.
What should an incident-readiness review cover?
Identify who receives an incident report, gathers facts, preserves evidence and makes escalation decisions. Review contacts for technical response, legal analysis, communications and business continuity. CISA’s small-business guidance recommends identifying these roles before a suspected incident.
Does every security event require breach notification?
Notification depends on the event, the information involved, affected people, applicable jurisdictions and contractual duties. A security alert alone does not answer those questions. An incident plan should assign responsibility for timely legal review and preserve a record of the facts supporting each notification decision.
Does a vendor’s security report settle the legal review?
No single report answers every contract or deployment question. Check its scope, period, exceptions and relevant service, then compare that evidence with the supplier’s promises and your own obligations. Identify what is still missing and who will resolve it before relying on the assurance.
Primary sources and further reading
- CISA: business logging and incident responsibilities
- New York breach-notification statute, General Business Law §899-aa
- New York Attorney General: data-breach reporting
General information. Applicable duties depend on the facts and scope of the matter.
START WITH THE QUESTION