The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Why? | |
|
|
Be prepared | |
Risk Assessment
| Toolkit
|
Key considerations | ||
Customer/individual rights
B2B relationships
| Reputation management
Commercial
Regulatory issues
| Privacy & data protection
Evidence
|
Response | |
Crisis Team
| Key Actions
|
Changes are coming to the UK’s cybersecurity legal landscape. The new Cyber Security and Resilience (Network and Information Systems) Bill aims to expand legal requirements to more sectors, tighten incident reporting rules, give the Government stronger powers to tackle cyber threats, and ramp up fines for serious breaches.
Member States were required to implement the NIS 2 Directive ("NIS 2") into national law by 17 October 2024. One year on, many EU Member States have failed to meet the transposition deadline, creating confusion and increasing compliance complexity for organisations across the EU.
The Cyber Resilience Act (the "CRA") entered into force on 10 December 2024 and applies in full from 11 December 2027. Manufacturers of in-scope products should start the compliance journey as soon as possible to avoid impacts to the product development cycle and non-compliance risk exposure.
White & Case Partners John Timmons and Clara Hainsdorf explore the key issues for organizations grappling with NIS 2 compliance in light of the complex implementation landscape.
On 14 January 2025, the Home Office opened a public consultation (the "Consultation") on proposals seeking to address the growing threat and impact of ransomware in the UK.
On October 16, 2024, the New York State Department of Financial Services (the "DFS"), under its Cybersecurity Regulation—23 NYCRR Part 500—issued a memorandum providing guidance on the risks posed by artificial intelligence ("Guidance Memo").
On October 21, 2024, the US Securities and Exchange Commission ("SEC") Division of Examinations ("Examination Division") announced its 2025 Examination Priorities ("Report"). Investment advisers and broker-dealers should ensure that policies, procedures and surveillance efforts related to these priorities address concerns outlined in the Report.
The U.S. Securities and Exchange Commission's ("SEC") Division of Enforcement has recently brought a spate of enforcement actions relating to key topics for public companies. These include enforcement actions related to cybersecurity incident disclosure, director independence and Regulation Fair Disclosure ("Reg FD") violations, which are described below, and actions based on Section 13 and 16 beneficial ownership filings, as discussed in our prior alert.
On July 18, 2024, a New York federal judge dismissed most of the US Securities and Exchange Commission's ("SEC") claims against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO"), Timothy G. Brown, in connection with the Company's cybersecurity practice.
The NIS 2 directive establishes a regulatory framework aimed at improving the level of cybersecurity across the EU.
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Member States were required to implement the NIS 2 Directive ("NIS 2")1 into national law by 17 October 2024. One year on, many EU Member States have failed to meet the transposition deadline, creating confusion and increasing compliance complexity for organisations across the EU.
NIS 2 is an EU cybersecurity directive that replaces Directive (EU) 2016/1148 ("NISD").2 The primary goal of NIS 2 is to uplift the level of cybersecurity across the EU (improving confidence in the market and resilience across important market sectors) and address the weaknesses and inadequacies of NISD. NIS 2 seeks to achieve this by:
The national laws implementing NIS 2 apply to a large number of businesses operating in the EU, many of which have had no prior direct exposure to specific cybersecurity legislation, including data centre service providers, social media companies and manufacturers.
For more information on NIS 2, you can watch our webinar which explores the key issues for organisations grappling with NIS 2 compliance.
As an EU directive, Member States must implement NIS 2 into domestic law before it becomes applicable and enforceable in that Member State.
The deadline for implementing NIS 2 into national law was 17 October 2024; however, the implementation landscape is fragmented, with many Member States failing to adopt transposing legislation.
On 7 May 2025, the European Commission sent a reasoned opinion to 19 Member States (including Germany, Ireland, Spain, and France) for failing to complete the transposition of NIS 2 by the deadline. The Commission warned those 19 Member States that if they did not respond to the Commission and take the necessary measures within two months, the Commission may decide to refer the matter to the Court of Justice of the European Union.
Despite the Commission's warning, only approximately half of Member States have transposed NIS 2 at the time of publication (e.g., Belgium, Croatia, Cyprus, Czech Republic (enters into force on 1 November 2025), Denmark, Finland, Greece, Hungary, Italy, Lithuania, Malta, Romania, Slovakia and Slovenia), leaving the remaining EU jurisdictions in a state of incomplete transposition (either partially or fully).
In practice, this means that organisations operating across multiple Member States (e.g., electronic communication service providers) have a complex compliance framework to contend with. This creates particular issues when it comes to incident reporting and overlapping regulatory supervision.
We expect the remaining Member States to prioritise implementation over the coming months, although timelines remain unclear. The lack of clarity is creating challenges for multinational organisations trying to implement compliance frameworks which scale across the EU.
For those organisations operating in Member States that have not yet implemented NIS 2, this time can be used to become familiar with the requirements of NIS 2, assess the impact on the organisations and current compliance status, and take steps to address material gaps.
Please contact John Timmons or Joe Devine if you have any questions, or if you require assistance with the matters discussed in this article.
Emily Digby (Trainee Solicitor, United Kingdom, White & Case) co-authored this publication.
1 Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive).
2 Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2025 White & Case LLP
