The federal government has been encouraging employers to adopt best practices to address both external and internal threats to critical business information and infrastructure. These best practices have included an important human resources element, including policies and programs covering current and former employees.

For example, the Obama Administration opened its initiative to combat trade secret theft with a report that listed human resources policies as one of four areas in which employers need to adopt best practices. Similarly, the Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology and the recently published Best Practices for Victim Response and Reporting of Cyber Incidents developed by the U.S. Department of Justice include multiple recommendations regarding human resources policies needed to manage cybersecurity risks. As we have noted before, employees can be among the best protectors of employers’ critical information, or its worst threat.

In a new development, some U.S. state governments are beginning to mandate human resources policies to address these threats. For now, the mandates extend to only to a limited range of policies—such as mandatory employee training and disciplinary measures—and apply only to certain industries, such as government contractors and health insurance entities (a category, by the way, that includes health insurers, health care centers, pharmacy benefits managers, third-party administrators, and utilization review companies).

It’s not hard to imagine these mandates expanding to cover more industries in more jurisdictions and a broader range of policies and procedures. Consider, for example, the impact a mandate might have that requires the clawback of compensation and benefits from executives for certain breaches of their cybersecurity obligations.

Our colleagues at InsidePrivacy have written a detailed blog post about the new state mandates, which is available for viewing here.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Richard C. Shea Richard C. Shea

Richard Shea is chair of Covington’s Employee Benefits and Executive Compensation practice and is widely regarded as the nation’s leading authority on cash balance, pension equity, and other complex benefit plan designs.  His practice spans the full breadth of activities needed to help…

Richard Shea is chair of Covington’s Employee Benefits and Executive Compensation practice and is widely regarded as the nation’s leading authority on cash balance, pension equity, and other complex benefit plan designs.  His practice spans the full breadth of activities needed to help his clients resolve novel, sensitive, or intractable issues.  His approach focuses on developing important new legal insights and ideas, and then combining them into effective litigation, legislative, regulatory, and benefit design strategies for his clients.

Photo of William Woolston William Woolston

Will Woolston is a partner in the firm’s Washington office who advises employers large and small on all aspects of employee benefits and executive compensation.  Mr. Woolston’s practice focuses significantly on tax-qualified retirement plans, with a particular emphasis on “hybrid” defined benefit plans…

Will Woolston is a partner in the firm’s Washington office who advises employers large and small on all aspects of employee benefits and executive compensation.  Mr. Woolston’s practice focuses significantly on tax-qualified retirement plans, with a particular emphasis on “hybrid” defined benefit plans like cash balance and pension equity plans.  Mr. Woolston regularly represents clients on matters before the Internal Revenue Service and the Department of the Treasury, and has assisted many companies in resolving with the IRS operational and administrative errors in qualified plans.  In addition to his qualified plan work, Mr. Woolston also advises clients on the full spectrum of executive compensation matters, including equity compensation arrangements, employment agreements, and compliance with the deferred compensation requirements of Section 409A of the Internal Revenue Code.

Photo of Ashden Fein Ashden Fein

Ashden Fein advises clients on cybersecurity and national security matters, including crisis management and incident response, risk management and governance, government and internal investigations, and regulatory compliance.

For cybersecurity matters, Mr. Fein counsels clients on preparing for and responding to cyber-based attacks, assessing…

Ashden Fein advises clients on cybersecurity and national security matters, including crisis management and incident response, risk management and governance, government and internal investigations, and regulatory compliance.

For cybersecurity matters, Mr. Fein counsels clients on preparing for and responding to cyber-based attacks, assessing security controls and practices for the protection of data and systems, developing and implementing cybersecurity risk management and governance programs, and complying with federal and state regulatory requirements. Mr. Fein frequently supports clients as the lead investigator and crisis manager for global cyber and data security incidents, including data breaches involving personal data, advanced persistent threats targeting intellectual property across industries, state-sponsored theft of sensitive U.S. government information, and destructive attacks.

Additionally, Mr. Fein assists clients from across industries with leading internal investigations and responding to government inquiries related to the U.S. national security. He also advises aerospace, defense, and intelligence contractors on security compliance under U.S. national security laws and regulations including, among others, the National Industrial Security Program (NISPOM), U.S. government cybersecurity regulations, and requirements related to supply chain security.

Before joining Covington, Mr. Fein served on active duty in the U.S. Army as a Military Intelligence officer and prosecutor specializing in cybercrime and national security investigations and prosecutions — to include serving as the lead trial lawyer in the prosecution of Private Chelsea (Bradley) Manning for the unlawful disclosure of classified information to Wikileaks.

Mr. Fein currently serves as a Judge Advocate in the U.S. Army Reserve.