The State of Cybersecurity and Worst Case Scenario The State of Cybersecurity and Lessons Learned 2016 ACC Mid-Year Meeting

Program Agenda Highlights from the State of Cybersecurity Report Managing risk, privilege and the investigation process Best practices for information sharing and working with regulators Incident response planning and what to do now Who should be on your go-to list Cybersecurity insurance and why most organizations don’t have enough Mistakes to avoid when communicating with the media

Speakers Charles Kallenbach, Chief Legal Officer and General Counsel, Heartland Payment Systems Edward J. McAndrew, Partner, Ballard Spahr LLP Stewart A. Pomerantz, Senior Vice President & Associated General Counsel, Jefferies LLC Phil N. Yanella, Partner, Ballard Spahr LLP

Why the ACC Foundation Conducted This Important Study Cybersecurity is a leading concern among in-house counsel Expanding role of in-house counsel 53% allocating more of their budget to cybersecurity

About the Report Data breaches by industry and region Top cybersecurity causes and concerns worldwide Company and legal department budgets Cybersecurity insurance Lessons learned Managing vendors and outside risk Detailed glossary of information security terms Self assessment tool for benchmarking And much more………..

How Would You Characterize Your Responsibilities Regarding Cybersecurity in Your Company?

in-house counsel experienced a data breach 31% of in-house counsel experienced a data breach

Most GC/CLOs and other in-house counsel do not know what standards their organization uses to address cybersecurity

Member of the Legal Department on a Data Breach Team?

How Was the System Breached?

Ranking of Immediate Concerns Related to Data Breach

Mandatory Cybersecurity Training for All Employees

How Does Your Organization Evaluate Company Preparedness at the Employee Level?

Portion of law department’s budget specifically dedicated to cybersecurity or related cyber issues

The Legal and Regulatory Landscape Class action litigation Consumer Financial Protection Bureau (CFPB) Cybersecurity Information Sharing Act (CISA) European Union (EU) Federal Trade Commission UK Financial Conduct Authority (FCA) US Securities & Exchange Commission (SEC)

What challenges did you face in preserving lawyer-client privilege after the data breach, and how did you navigate these?

Less than half of the respondents say their company has cybersecurity insurance

Did Insurance Cover the Damages Incurred From the Breach?

General Counsel and Lessons Learned “No firewall can give 100% protection” “How much time is involved in responding to a breach” “Act fast and get out ahead of the news and the regulators” “Some employees working from home are on their own unencrypted devices”

Crisis Management Dos Prepare a three-tiered incident response plan Test the plan quarterly for vulnerabilities Identify a centralized decision maker (in legal) Join an industry based ISAC (Information sharing and analysis center) Select and media train a spokesperson Stay ahead of the news curve

Crisis Management Don’ts Assume cybersecurity is an IT issue Provide lost record numbers and breach details to media prematurely Rely on text book incident response plans Limit response to only US state law or other regulatory notification requirements Select and media train a spokesperson

What Resource Was Most Helpful? An outside call center In-house privacy counsel Having an established incident response team Chief privacy officer and local law enforcement Subject matter experts and a single center point of contact Retaining outside counsel and experts Office of Australian Information Commissioner Guidelines

“Act as if you’ve already been breached”

For addition information: Derede McAlpin ACC, Vice President & Chief Communications Officer mcalpin@acc.com ACC FOUNDATION: THE STATE OF CYBERSECURITY REPORT Price: Members - $475 Non-Members - $595 www.acc.com/cybersecurity Underwritten by: