Privacy, Cyber & Data Strategy Advisory | Cybersecurity Controls: What Do Regulators Expect Nowadays?

Executive Summary

Our Privacy, Cyber & Data Strategy Team highlights the increasingly specific cybersecurity controls identified by regulators, explains why these enhanced cybersecurity controls have become the focus of regulators, and shares practical tips for companies navigating this rapidly evolving territory.

• At the state and federal levels, regulators expect companies to adopt phishing-resistant multi-factor authentication
• Regulators' training requirements are shifting from standard "off the shelf" security awareness programs to multifaceted models that include role-based training
• Going forward, one of the more challenging enhanced controls for companies is to develop and maintain a comprehensive, up-to-date asset and software inventory