The task of managing cyber risks is no longer the near-exclusive realm of IT professionals. Now a major concern of attorneys, senior executives, and directors, it has led to the release of Practising Law Institute's (PLI) newest title, “Cybersecurity: A Practical Guide to the Law of Cyber Risk,” the first major legal treatise on this crucial area of the law.

Authored by 20 legal and cybersecurity experts, the new guide provides practical steps that can be taken to help clients “understand and mitigate today's cyber risks and build the most resilient response capabilities possible.” The treatise also discusses the complex legal framework of federal and state statutes, executive orders, regulations, contractual norms, as well as the ambiguous tort duties that can apply to this area of law.

The guide describes in detail:

  • The leading regulatory role played by the Federal Trade Commission, acting on its authority to regulate “unfair” or “deceptive” trade practices;
  • The guidance issued by the SEC interpreting existing disclosure rules to require registrants to disclose cybersecurity risks under certain circumstances;
  • The varying roles of other regulators in sector-specific regulation, such as healthcare, energy, and transportation; and
  • The impact of preexisting statutes, such as the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act, on current cybersecurity issues.

The authors of “Cybersecurity: A Practical Guide to the Law of Cyber Risk” have taken an extra step to supplement these more traditional sources of law with industry practices, as well as soft law, including:

  • An explanation of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and information sharing environments from a former Department of Homeland Security official;
  • The views of the U.S. Secret Service on partnering with federal law enforcement and effective information-sharing;
  • The guidance of leading consultants about the appropriate steps to prepare for cybersecurity incidents;
  • The perspective of a leading insurance company on the evolving role of insurance in protecting companies from the financial losses associated with a successful cyber breach; and
  • The views of one of the most sophisticated incident response organizations on the proper elements of effective incident response.

Available on Amazon for $395, the book includes practice tools developed during hundreds of breaches, such as an overview of the legal consequences of a breach, and a tabletop exercise.