Michael A. Sussmann

The legal landscapes for privacy and cybersecurity continue to evolve rapidly, presenting both challenges and opportunities for innovative companies. Indeed, 2024 was a busy year, with the enactment of a number of new federal and state laws covering protections for personal data, enhanced data breach notifications, AI regulation, and more.

On July 18, Judge Paul Engelmayer of the Southern District of New York issued a lengthy order dismissing the majority of the SEC’s enforcement case against SolarWinds Corporation (SolarWinds) and its CISO, Timothy Brown. The ruling is relevant for any company crafting disclosures about its cybersecurity practices, and also includes important analysis for securities fraud cases more broadly, including what constitutes pleading by hindsight and speculation.

On July 26, the U.S. Securities and Exchange Commission adopted rules to enhance and standardize public company disclosure of cybersecurity incidents, risk management, strategy and governance. In particular, the rules, which were proposed on March 9, 2022 (see alert), will require current reporting on Form 8-K of material cybersecurity incidents within four days of determining materiality, as well as annual disclosures about a company’s processes to assess, identify and manage material risks from cybersecurity threats; management’s role in assessing and managing material risks from such threats; and the board’s role in providing oversight of such material risks. The key provisions of the rules are summarized in this alert.

Presented by Cybersecurity Docket, Incident Response Forum Masterclass 2025 is a one-of-a-kind conference focused on incident response and ransomware attacks, specifically catered to legal and compliance professionals who tackle the aftermath of a data security incident. Partner Michael Sussmann will join 30+ industry leaders and senior government officials from the FBI, DOJ, SEC, and CISA to discuss the pressing issues that professionals in the sector face. Join Michael for his panel on “Working with Law Enforcement: Balancing Cooperation with Potential Risks.”

CLE compliance deadlines are approaching, and Fenwick’s got you covered. Join us for our annual virtual CLE Speaker Series, where you’ll earn MCLE credit and get a front-row seat to the latest legal updates and insights in dynamic practice areas from Fenwick’s lawyers.

Preparing for an IPO or acquisition requires readiness from all aspects of a business, including information security. Partner Michael Sussmann will join a panel during the ICON Cyber Day to discuss the key points a CISO should keep in mind during this phase of a company's growth from a legal perspective.

Presented by Cybersecurity Docket, Incident Response Forum Masterclass 2024 is a one-of-a-kind, virtual conference solely focused on incident response and ransomware attacks. Sessions are geared specifically toward the legal and compliance professionals who are critical players in the aftermath of a data security incident. Partner Michael Sussman will join 30 other leaders in the incident response field serving on ten panels, including senior government officials from the FBI, DOJ, and SEC, to discuss the most important issues now facing attorneys and professionals who work in this area. Join Michael for his panel on "The Cyber Threat Landscape: Preparation and Remediation."

Fenwick is excited to be moderating a discussion on privacy with FBI Leadership at this year's IAPP Global Privacy Summit. On April 3, partner Michael Sussmann will be joined by Jonathan Lenzner, Chief of Staff to the FBI Director, and Cynthia Kaiser, Deputy Assistant Director of the FBI's Cyber Division, as they discuss how the FBI protects the privacy of Americans while undertaking its mission. The conversation will include the FBI’s use of AI and other emerging technologies, and its reliance on data-driven investigations in countering malicious cyber operations. Learn more about the Think Tank session "A Discussion on Privacy with FBI Leadership" here.