cybersecurity risk assessment

Davis Polk & Wardwell has announced the launch of a new cybersecurity assessment portal that helps clients identify their notification requirements under state, federal and international  laws after they experience a cyberattack or breach.

The web-based portal also offers automated notification letter templates that satisfy pertinent cyber breach notification laws.

Avi Gesser, a Davis Polk partner who also runs the firm's incident response group, said the idea of the portal came from many clients struggling to comply with multiple state and federal breach identification laws.

The notification assessment tool in the portal asks if the client owns or processes certain data, and if the client is regulated by the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act or other U.S. laws. Further questions include if the data breached was in electronic or physical form, the types of personal information breached, and what state the client conducts business in.

Gesser explained that very often the guidance the firm provides to a client was generalized from a specific question a client asked. He also noted breach notification statutes updated by legislation or case law are also updated in the portal.

The portal also provides “tabletop exercises” to mock a standard breach, ransomware attack, or a cloud breach, and checklists to help clients prepare for cyber incidents. Gesser noted that companies can use the portal's tabletop exercises to demonstrate their cybersecurity preparedness to regulators, specifically in terms of their breach notification obligations. 

In a presentation shown to Legaltech News, Gesser showcased sections of the portal that included a ransom checklist that lists what to do when a client pays or doesn't pay a ransom, or when its vendor is breached and data is held for ransom.

The program also supplies a General Data Protection Regulation breach notification checklist, a data process assessment checklist and sample notices used to alert authorities and individuals of compliance. Gesser noted, however, that the GDPR checklist doesn't include templates for breach notifications because EU countries haven't provided all of their guidance for the regulation that went into effect May 25.

While client data is added into the portal, Gesser noted the program will require two-step authentication for access once the program is out of its beta stage. What's more, he said the potential client data wouldn't be anything particularly sensitive. 

Davis Polk did not disclose the cost of using the portal, but added it was only available to the law firm's clients.