Governance & Regulation

Cyber-security is now a body of hard law, not best practice, and the obligations vary sharply by jurisdiction and sector. A firm operating across borders may face EU, US federal, US state and sector-specific rules at once.

This report sets out the regulatory framework in your chosen jurisdiction and industry: the regimes that apply, from NIS2 and GDPR to securities disclosure rules and sector regimes, and the deadlines that differ across them.

It documents the enforcement pattern, multi-million penalties for security and disclosure failures, mandated programme rebuilds, and parallel investigations from a single incident, each with its own timeline and disclosure duty.

It covers the mapping exercise that prevents this, the jurisdiction and sector regimes, their duties and exact reporting deadlines, and when to engage regulatory and privacy counsel to validate the map as law and business change.

When a breach happens, the notification decision is often the most consequential and time-critical judgement a firm makes, and the clock starts at discovery, not at convenience. Penalties for getting it wrong can exceed those for the breach.

This report sets out the notification framework in your chosen jurisdiction and industry: how the obligations stack, from GDPR's 72 hours and NIS2's 24-hour initial notice to state and sector deadlines, and why the duty turns on data type and affected individuals.

It documents the pattern regulators have set, penalising late, incomplete or misleading notification as heavily as the breach itself, while a single incident can require dozens of distinct notifications on different timelines.

It covers the preparation that holds under pressure, a current data map, pre-drafted templates and rehearsed ownership, and when to engage breach counsel and forensic specialists to establish scope.

Cyber-security has become a board-level duty with personal dimensions for directors. Inadequate board attention is itself a governance failure, and cyber is no longer wholly delegated to technical staff.

This report sets out the oversight framework in your chosen jurisdiction and industry: the disclosure of board cyber-risk oversight that listed-company rules require, the management-body responsibility and potential personal liability under NIS2, and the rising reasonable-oversight standard.

It documents the consequences where oversight cannot be evidenced, regulatory findings, shareholder derivative suits following major breaches, and direct consequences for officers who overstated security or delayed disclosure.

It covers what demonstrable oversight looks like, board reporting in business terms, a named accountable executive, cyber on the risk register with a defined appetite, and when to engage independent advisers for an external read.