As the amount of online data about consumers multiplies, so does the number and sophistication of attackers trying to get it. And the issue becomes critical as the attacks target corporate intellectual property and the nation's infrastructure.

But like other privacy-related issues, Congressional agreement on national cybersecurity legislation has been elusive. Late last year, a cybersecurity bill died in a Senate filibuster after the U.S. Chamber of Commerce lobbied against it.

Unwilling to wait for Congress, the Obama administration at press time was circulating a draft executive order creating federal structures to address cybersecurity and requiring private sector interests to exchange information. Washington observers expect the president to issue the order shortly. 

“He can't go as far in an executive order as the Congress can in legislation, but there is still concern about how far-reaching it will be and what obligations would be imposed on private sector firms,” says William Baker, of counsel at Wiley Rein. 

Even without an executive order, in-house counsel should be taking steps to protect data, Baker says, including risk assessment, mitigation strategies, examining fiduciary duties and reviewing notification requirements.

Christopher Wolf, a Hogan Lovells partner, agrees. “Paying attention to cybersecurity is a business imperative,” he says. “There are repeated attacks on infrastructure, and businesses need to protect their trade secrets and preserve the ability to operate their business. There are also privacy issues if personal data is affected. I expect to see more attention by Congress and the SEC [Securities and Exchange Commission] to corporate disclosures on cybersecurity.”

Meanwhile the Republican-controlled House has tried and failed to advance a data breach notification law to supersede the current patchwork of 46 state laws with differing notification provisions.

“The issues involve what the standards for notification would be,” Baker says. “And while the [GOP-controlled] House committees want a stand-alone breach notification bill, it doesn't advance because they know if they passed a bill, the [Democrat-controlled] Senate would add other consumer privacy provisions and send it back. So it doesn't get anywhere.”