In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators. Traditionally, cybersecurity compliance that is tied to the protection of personal information generally has required entities to implement "reasonable security," without much guidance on what "reasonable security" means. At the federal level, the Federal Trade Commission ("FTC") has led the charge with enforcing cybersecurity requirements related to consumer privacy based on this "reasonable security" standard. At the state level, a reasonableness standard for the protection of personal data persists as well, although over a decade ago Massachusetts notably required companies to implement a Written Information Security Policy to further protect their citizens' information.¹

Companies may become subject to far more exacting cybersecurity standards when either the underlying personal data is especially sensitive or when critical infrastructure is at risk. At the federal level, examples include a specific "Security Rule" adopted by the US Department of Health and Human Services ("HHS") to safeguard protected health information under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"),² and a myriad of demanding requirements that are enforced across the financial and energy sectors.

Meanwhile, at the state level, the most comprehensive cybersecurity requirements have occurred within the context of financial services regulation, and in particular, emanate from the New York Department of Financial Services Cybersecurity ("NYDFS") Requirements for Financial Services Companies ("Cybersecurity Regulation").³  The NYDFS Cybersecurity Regulation was promulgated in 2017, went into effect in early 2018, and established initial compliance deadlines in August of that year. The regulation sets forth specific administrative, technical and physical requirements, which we have explored previously at length.⁴ The rules require covered banks, insurance companies and other financial services institutions to implement a thorough, 14-point cybersecurity policy and submit an annual certification that confirms their compliance with the rules. Covered entities must also document improvements they may need to make to their cybersecurity programs. These covered entities not only have to consider "relevant risks" to their businesses but also must "keep pace with technological advances."

Financial services companies are holding their breath as NYDFS recently set an October 2020 hearing date for the first enforcement action under the Cybersecurity Regulation. In that matter, a regulated entity allegedly exposed more than 850 million documents, any of which included sensitive, non-public information such as consumer financial records. Only time will tell whether NYDFS is sounding the alarm to covered entities that, despite a two-year enforcement hiatus, the Cybersecurity Regulation is alive and well, and perhaps especially hungry after having been so long in hibernation.

FTC Cybersecurity Enforcement Approach

Pursuant to its authority under Section 5 of the Federal Trade Commission Act ("FTC Act"), the FTC has brought nearly 70 enforcement actions against companies for failing to implement reasonable security. Consistent with the FTC's authority to protect consumers, FTC enforcement of data security requirements focuses on the security of consumer information. Until recently, the FTC's standard for "reasonable security" was fairly amorphous. Enforcement actions would often result in consent orders that generally required entities to implement a cybersecurity program that provided little in the form of specific policies, processes and controls.

In 2018, the FTC's approach suffered a heavy defeat when a court rendered one of the FTC's cease and desist orders to be unenforceable because it failed to specify the precise cybersecurity measures that the respondent was required to implement. In the long-running LabMD matter, the FTC alleged that LabMD failed to implement reasonable and appropriate measures to prevent unauthorized access to consumers' personal data stored on its computer systems. As a result, unauthorized individuals (in the form of a security company) were able to access sensitive information including patient names, dates of birth, Social Security numbers and bank account information. According to the FTC, the inadequacy of LabMD's data security program constituted an "unfair act or practice" under the FTC Act.

The 11th Circuit determined that an FTC Consent Order requiring LabMD to implement "a comprehensive information security program reasonably designed to protect the security and confidentiality of the personal consumer information in its possession" was unenforceable. The Court based its determination on the fact that the order did not identify any specific act or practice of LabMD for remediation and required conformance with an "indeterminable standard of reasonableness."

Since the LabMD decision, the FTC has taken steps to reframe its approach to reviewing the "reasonableness" of the data security practices of companies. In its recently released 2019 Privacy and Data Security Update, the FTC notes that it has "strengthened its standard orders in data security cases" and has required companies to "implement a comprehensive security program, obtain robust biennial assessments of the program, and submit annual certifications by a senior officer about the company's compliance with the order." The FTC stated in a recent enforcement action that it has implemented "additional and significant improvements" to its data security orders that identify safeguards to address specific allegations in an FTC complaint, including access controls, vendor management, encryption of sensitive data, and vulnerability and penetration testing. According to the FTC, future orders likely will also address governance issues, requiring the involvement of executive management and use of third-party assessors in evaluating risks.

NYDFS Begins Enforcement

On July 22, 2020, NYDFS submitted a Statement of Charges and Notice of Hearing ("SOC") alleging that First American Title Insurance Company ("First American") exposed tens of millions of documents containing sensitive consumer personal information, such as bank account numbers, Social Security numbers and drivers' license images. According to the FTC, the exposure was due to a vulnerability in the company's public-facing website that permitted the URL to be manipulated to view personal information in First American's consumer files. NYDFS alleged that the company was aware of the vulnerability but failed to properly designate the severity of, and to timely remediate, the vulnerability in accordance with its own policies. Specifically, the SOC alleged multiple violations of the Cybersecurity Regulation, including:

• Failure to perform a risk assessment for data stored or transmitted within its information technology system that was sufficient to inform the design of the cybersecurity program
• Failure to maintain and implement data governance and classification policies suitable to its business model and associate risks
• Failure to implement reasonable adequate access control to prevent access to NP
• Failure to provide data security training to employees and agents responsible for identifying sensitive data
• Failure to encrypt sensitive data on the company's information technology system.
   

Perhaps most significantly, NYDFS alleged egregious failures in the company's remediation efforts after its own cybersecurity experts ultimately identified the underlying issues and encouraged the company to address those issues as soon as possible. Notably, although the NYDFS enforcement action occurred in the context of a vulnerability that exposed a massive amount of data to the public, it does not allege that any harm occurred to any consumers or to the business at large.

In addition to requiring the entity to remedy its violations, the NYDFS is seeking penalties that could prove substantial. NYDFS asserted in the SOC that upwards of 850 million documents may have been improperly exposed. The agency has claimed it can seek penalties of up to $1,000 per violation, noting that "each instance of Nonpublic Information encompassed within the charges constitutes a separate violation." A hearing is scheduled for October 26, 2020, to determine whether any violations have occurred and, if so, the amount of penalties.

The Future of US Mandated Cybersecurity

While the NYDFS Cybersecurity Regulation imposes significant administrative, technical and physical compliance obligations on covered entities regarding all non-public information (going well beyond personal data) and the integrity and resilience of the financial networks themselves, the regulation does so with precision and specificity that historically has been lacking under cybersecurity enforcement action by regulators focused strictly on consumer data. Although burdensome, the detailed requirements under the Cybersecurity Regulation gives entities a clear roadmap of the precise measures, processes and controls necessary for compliance.

At the federal level, and in the wake of LabMD, the FTC appears to be aligning with the NYDFS standard by moving toward more precise rules and clarifying expectations. The FTC continues to do so not only through consent orders, but also in changes to data security guidelines promulgated under other statutes for which the FTC has enforcement authority. For example, in 2019, the FTC proposed amendments to the Safeguards Rule under the Gramm-Leach-Bliley Act to incorporate more "detailed guidance as to what an appropriate information security program entails" for financial institutions.

As more precise cybersecurity requirements arise, including with specific regard to consumers such as under the New York SHIELD Act,⁵ and enforcement activity increases, organizations should expect that cybersecurity requirements will begin to demand greater alignment with popular or industry-recognized standards. The future of US cybersecurity compliance will necessitate a thorough review of existing processes, and implementation of relevant and appropriate controls, according to prescriptive requirements provided by regulators. Increasing enforcement activity coupled with specific requirements should prompt directors and executive management to prioritize compliance as a first step, and ensure that adequate resources are available that go beyond mere compliance and result in a cybersecurity program that aligns against the company's risk profile as well.

[View source.]