We help domestic and multinational organizations manage the full lifecycle of data, privacy, and cybersecurity risk – from building global privacy programs to responding to high-stakes incidents and defending regulatory investigations and class actions. Our lawyers and security professionals work side-by-side with clients, consultants, and forensics providers to protect and mitigate risk-of-harm to data, operations and reputation.

We have deep experience in counseling clients on global privacy and information security programs, spanning Board oversight, management risk-based decisioning, and frontline operations. We advise on data governance, stewardship, and compliance; crisis management for privacy and data security incidents; government and internal investigations into data processing activities; and responsible and ethical deployment of AI and machine learning. 

Our incident-response experience informs proactive counseling, including reviews and gap analyses of privacy and security policies and controls, mitigation measures against ransomware and other known threats to IT and operational technology systems, cybersecurity contingency and recovery planning, and cybersecurity architecture design reviews.

Our capabilities include data protection, privacy, and cybersecurity assessments; incident response and insider threat preparedness; defense against litigation and regulatory enforcement actions; and developing compliance programs.  Specifically:

• Cybersecurity incident response and preparedness, including root-cause investigations, crisis management, public relations, notifications, coordination with incident response vendors, coordination with law enforcement and regulators, congressional inquiries, and follow-on litigation.
• Forensics investigations and technical knowledge through a collaborative team of security professionals, consultants, and forensics providers.
• Global privacy compliance spanninginternationaland state privacy and information security laws.
• Workplace privacy and strategic workforce compliance, including protection of employee data and biometric data.
• Government inquiries, investigations, and enforcement defense, including matters involving multi-stateattorneysgeneral and federal agencies such as the FTC, SEC, and DOJ.
• Data breach class actions and privacy litigation, including strategies for staging discovery, briefing critical issues, expert-witness management, and complex privilege issues,bringing together boots-on-the-ground crisis managers, technical professionals, former government lawyers and trial-ready litigators to coordinate fast-moving investigations and complex logistics during and after an incident.
• Threat mitigation, including risk and gap analysis, insider threat program coordination and implementation, and development of Concepts of Operations and Standard Operating Procedures.
• Board-level and C-suite guidance,advising on privacy and data security policies and controls to ensure thoughtful and effective corporate governance, inventorying data environments and crafting policies and controls that satisfy industry standards andcomply withcomplicated regulatory frameworks.