Benjamin R. Pedersen – Debevoise Data Blog

Announcement

Debevoise Data Blog: Top 5 Cybersecurity Blog Posts of 2025

By: Andrew J. Ceresney, Charu A. Chandrasekhar, Luke Dembosky, Avi Gesser, Daniel M. Gitner, Erez Liebermann, Jim Pastore, Benjamin R. Pedersen, Jeff Robins, Julie M. Riewe, Kristin Snyder, Matt Kelly, HJ Brehmer, John Jacob, Gabriel Kohan, Amer Mneimneh, Andreas Constantine Pavlou, Lily Schoen, Cameron Sharp, Stephanie Thomas and Cindy Tu December 10, 2025

As we approach the end of the year, here are the Top 5 Cybersecurity posts on the Debevoise Data Blog in 2025. 1. Protecting Privilege in Incident Response: Litigation Lessons…

SEC

Financial Services Industry Petitions the SEC for a Rulemaking to Amend the Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure Rule

By: Erez Liebermann, Benjamin R. Pedersen, John Jacob, Stephanie Thomas and Cindy Tu May 27, 2025

Debevoise’s Data Strategy and Security group recently assisted five leading financial services industry trade associations in preparing a joint rulemaking petition in response to the Securities and Exchange Commission’s (“SEC”)…

Artificial Intelligence

Top 10 SEC Cyber/AI Blog Posts for 2024

By: Andrew J. Ceresney, Charu A. Chandrasekhar, Luke Dembosky, Avi Gesser, Eric T. Juergens, Arian June, Robert B. Kaplan, Erez Liebermann, Sheena Paul, Benjamin R. Pedersen, Marc Ponchione, Jeff Robins, Paul Rodel, Julie M. Riewe, Kristin Snyder, Jonathan R. Tuttle, Phil Fortino, Matt Kelly, Anna Moody, Stephan J. Schlegelmilch, Johanna Skrzypczyk, Suchita Mandavilli Brundage, Kelly Donoghue, Andreas A. Glimenakis, Alice Gu, John Jacob, Gabriel Kohan, Talia Lorch, Ciera Mandelsberg, Noah L. Schwartz, Ned Terrace and Mengyi Xu December 12, 2024

As we approach the end of the year, here are the Top 10 SEC Cyber/AI posts on the Debevoise Data Blog in 2024 by page views. If you are not…

Enforcement

SEC Charges Four Companies for Misleading Cyber Disclosures

By: Andrew J. Ceresney, Charu A. Chandrasekhar, Luke Dembosky, Erez Liebermann, Benjamin R. Pedersen, Julie M. Riewe, Matt Kelly, Anna Moody, Kelly Donoghue, Ciera Mandelsberg and Noah L. Schwartz October 28, 2024

On October 22, 2024, the U.S. Securities and Exchange Commission (the “SEC”) announced settled charges in separate actions against four technology companies—Avaya Holdings Corp. (“Avaya”), Check Point Software Technologies Ltd.…

Cybersecurity

Internal Accounting Controls Claim Rejected in SolarWinds Case

By: Andrew J. Ceresney, Charu A. Chandrasekhar, Luke Dembosky, Erez Liebermann, Benjamin R. Pedersen, Julie M. Riewe, Paul Rodel, Matt Kelly, Anna Moody, Alice Gu and Talia Lorch July 23, 2024

On July 18, 2024, in the landmark SEC v. SolarWinds Corp. case, U.S. District Judge Paul Engelmayer dismissed the majority of the claims brought by the U.S. Securities and Exchange Commission (the…

Business

SEC Releases New Guidance on Material Cybersecurity Incident Disclosure

By: Paul Rodel, Benjamin R. Pedersen, Erez Liebermann, Eric T. Juergens, Anna Moody, John Jacob and Kelly Donoghue June 27, 2024

June 27, 2024 On June 24, 2024, the staff of the Division of Corporation Finance of the Securities and Exchange Commission (the “SEC”) released five new Compliance & Disclosure Interpretations…

Cybersecurity

Incident Response Plans Are Now Accounting Controls? SEC Brings First-Ever Settled Cybersecurity Internal Controls Charges

By: Andrew J. Ceresney, Charu A. Chandrasekhar, Luke Dembosky, Avi Gesser, Erez Liebermann, Benjamin R. Pedersen, Julie M. Riewe, Matt Kelly, Anna Moody and Andreas A. Glimenakis June 20, 2024

In an unprecedented settlement, on June 18, 2024, the U.S. Securities & Exchange Commission (the “SEC”) announced that communications and marketing provider R.R. Donnelley & Sons Co. (“RRD”) agreed to…

Cybersecurity

100 Days of Cybersecurity Incident Reporting on Form 8-K: Lessons Learned

By: Charu A. Chandrasekhar, Erez Liebermann, Benjamin R. Pedersen, Paul Rodel, Matt Kelly, Anna Moody, John Jacob, Kelly Donoghue and Talia Lorch March 28, 2024

On December 18, 2023, the Securities and Exchange Commission’s (the “SEC”) rule requiring disclosure of material cybersecurity incidents became effective. To date, 11 companies have reported a cybersecurity incident under…

Announcement

Announcing the Debevoise Tracker for Cybersecurity Incident Disclosure on Form 8-K

By: Avi Gesser, Benjamin R. Pedersen, John Jacob and Talia Lorch March 6, 2024

In July, we previewed the new rules adopted by the Securities and Exchange Commission (“SEC”) for Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Under these rules, Item 1.05 of…

SEC