Cybersecurity is top of mind for most businesses, and while general counsel and law departments can sometime be disconnected from the IT department, that doesn't make them any less responsible or vulnerable to these risks. Viruses, fraud and unwarranted intrusion can leak sensitive information and potentially damage your vital infrastructure. Now, more than ever, effective strategies that address current and future cyber risks are essential to the operation of your department. But without any background identifying and mitigating security risks it can be tough to know where to start. 

Wanji Walcott, managing counsel at American Express, has 19 years of experience counseling diverse businesses, and leads a team that provides global legal support in a number of a technology-focused areas. Walcott will address cybersecurity issues during the upcoming Women, Influence and Power in Law Conference during the session, “Cybersecurity and the Legal Department,” in Washington, D.C. InsideCounsel recently had an opportunity to speak with Walcott about some of the challenges and strategies she recommends law departments use when addressing cybersecurity risks. Below is the full exchange:

IC: Can you talk about your personal experience dealing with cybersecurity?

WW: I manage a team of attorneys focused on (among other issues) cybersecurity needs. We provide extensive advice on complying with breach notification statutory and regulatory obligations, negotiate our information protection contract requirements, engage resources for our data security auditing, and provide input on our global data security standards. We also regularly work with third parties in the payment cards industry on their cybersecurity issues relevant to our merchant and processor relationships.

IC: What are the biggest cybersecurity concerns for legal departments these days?

WW: Keeping pace with the fast moving developments in this arena is of paramount concern. Federal financial regulators and European data protection agencies routinely issue a wide range of guidance documents. Additionally, the number of laws in this area is developing rapidly in the United States, the European Union, and worldwide. This is particularly the case for companies whose goods and services are deemed by government authorities to be “critical infrastructure” or key “market operators”.

IC: What concerns are just over the horizon that you think legal departments should be aware of?

WW: Vital areas of legal interest include tracking the implementation of the President's executive order on critical infrastructure (including the development of the preliminary and final frameworks by the National Institute for Standards and Technology), as well as the development of the European Union's General Data Protection Regulation and the network and information security directive. Additionally, legal departments increasingly find themselves providing advice on changes to the wide range of U.S. state breach notification laws in light of safe harbors for companies complying with similar federal laws.

IC: How can legal departments strengthen their awareness of threats? 

WW: Maintaining a close relationship with your company's chief information security office is an excellent idea. Additionally, joining the information security working groups within organizations related to one's industry.  For those of us in financial services, forming associations with organizations like the Financial Services Sector Coordinating Council, the American Bankers Association, the U.S. Council for International Business, the Consumer Bankers Association, the Direct Marketing Association and other trade associations has proven quite helpful. 

IC: What basic things can legal departments do to defend themselves from cyber risk?

WW: One can enhance the company's cybersecurity posture by ensuring that your attorneys have a thorough understanding of the company's security incident response program, and play a role in formulating and updating program procedures. Attorneys can offer valuable advice regarding expedited time frames, escalation, and proper communication (internally and with regulators) for incidents likely to result in significant unauthorized access to data or system performance challenges. Increasingly, departments are also becoming more adept at understanding cybersecurity insurance policies in light of likely security incidents.

The upcoming Women, Influence & Power in Law conference offers an opportunity for unprecedented exchange with women outside counsel.The event, which runs from Oct. 2-4, will be held at the Wardman Park Hotel in Washington, D.C.