Is Breach Mitigation The Next Wave Of Cybersecurity Regulation?

More and more, regulators are focusing their rulemaking power not just on how a company responds (or doesn't respond) to a data breach, but the steps it took far in advance to prevent or mitigate such a breach.

Two new sets of regulations — the European Union's General Data Protection Regulation (EU GDPR) and a stringent new cybersecurity regulation from the New York Department of Financial Services — fall into this breach mitigation category, and are catching the eye of all companies that collect, store or process customer data.

For an in-depth overview of these regulations and this recent shift to pre-breach mitigation requirements, join us Tuesday, Feb. 21, for a free webinar hosted by Advisen. The webinar, "The Next Wave of Cyber Regulation" will feature up-to-the-minute commentary and analysis on the effects of these upcoming regulations and the likelihood of more in the future.

General Data Protection Regulation (EU GDPR)

The EU GDPR looms large for any firms or companies that handle the data of European customers. The measure, which goes into effect on May 25, 2018, will apply to any entity that captures or processes the data of EU data subjects — even if in relation to a free good or service.

This will be an entirely new area of risk for many U.S.-based entities, one that imposes significat accountability requirements and carries the threat of serious fines — up to €20 million or four percent of global turnover for the preceding financial year, whichever is greater.

One key element of the EU GDPR is the requirement, in certain circumstances, for firms to designate a data protection officer (DPO). This position, which must be in place by the law's effective date, can be either an employee with a...