If your organization is facing an actual or suspected security incident, we can help you triage the issue, manage the incident response, engage external incident response vendors under privilege on your behalf, conduct internal investigations, comply with security breach notification laws, and defend resulting regulatory inquiries and civil litigation.

We can advise on the security requirements of state, federal, and international security laws, including HIPAA, GLBA, state “reasonable security” laws, and GDPR, and state and local security breach notification laws, as well as self-regulatory frameworks like the PCI-DSS.

We can help you conduct information security assessments and provide legal analysis of risk exposure. We can also provide information security technology counseling and remediation planning for topics such as identity and access management, threat intelligence and mining, cryptography, data loss prevention, and secure disposal. We are also able to assist with vulnerability and patch management as well as bug bounty programs.

We can help you develop information security policies that articulate corporate practices in a way that satisfies legal requirements and meets industry best practice guidance for plain language and transparency. We can also help you develop and implement related security policies and procedures, including incident response plans, record retention policies, acceptable use policies, responsible disclosure/bug bounty policies, and related policies.

We can provide general product counseling, especially for Internet of Things (IoT) devices and connected technology, wearables, cloud solutions, sharing economy platforms, and augmented reality devices. We can also assist with secure development lifecycle management.

We can assist you with finding threat actors (e.g., hackers) and disincentivizing future attacks through cease and desist letters, U.S. litigation/asset seizure, website domain take-downs, and coordination with law enforcement.

We can provide tailored training for your employees, including general security awareness training, phishing and spearphishing training with social engineering prevention guidance, and end-user compliance training.

We can provide pre-audit, privileged compliance review for audit standards (e.g., PCI-DSS, HIPAA, GLBA, NIST 800-53, NIST Cybersecurity Framework, SANS CIS 18, and ISO 27001). We can also help coordinate with external auditors to ensure appropriate scoping/remediation requests.

We can perform information security due diligence for vendors, corporate acquisitions, or equity investments. We can also draft templatized or custom security addenda for vendors and customers, including by creating security addenda negotiation “playbooks.”