• |

    Oct. 28, 2026

Putting NYDFS Comprehensive Guidance on Cybersecurity Risk Assessments Into Practice

Cybersecurity Awareness Month is an apt time for organizations to assess whether their cybersecurity programs are grounded in thorough, documented risk assessments, an area drawing increased attention from the New York State Department of Financial Services. The agency’s new guidance identifies common deficiencies and details five essential elements of an effective process, including governance and oversight, methodology, scope, documentation, and integration and updates. With insights from partners at Clifford Chance and Mayer Brown, this article examines the guidance and its implications and explains how organizations can use it to strengthen assessments, align controls with identified risks and prepare for regulatory scrutiny. See “How the NYDFS Drives Cybersecurity in the Financial Services Industry” (Jun. 23, 2021).

California Regulators Offer Insights Into Enforcement, Audit Priorities

Companies devote significant resources to anticipating privacy regulators’ policies and priorities. As California’s privacy framework expands into AI and proactive audits, understanding how its regulators interpret and enforce the rules is increasingly critical. Stacey Schesser of the Office of the California AG and Sabrina Ross and Laura Kehoe Hoffman of CalPrivacy offered insights into the agencies’ enforcement priorities, compliance expectations and privacy audits at the recent U.S. Privacy Summit sponsored by Ketch, Kelley Drye, and Women in Security and Privacy. This article distills their commentary, including practical takeaways for companies navigating California’s evolving privacy regime. See “Connecticut, Delaware and New Jersey AG Reps Discuss Privacy Enforcement” (Aug. 12, 2026).

Practical Guardrails for Employers’ Use of AI

As employers increasingly use AI tools in hiring, monitoring and termination decisions, they must implement effective governance, human oversight and accountability to reduce litigation and regulatory exposure. Distilling insights shared by experts from Pillsbury, Zelis and Uber during a panel at IAPP Privacy.Security.Risk. + AI Governance Global 2026, this article examines employers’ use of AI throughout the employment lifecycle and offers practical strategies for managing the resulting risks. See “Preparing for California’s ADMT Rules” (Oct. 7, 2026).

Former White House Information Governance Director Joins Baker Donelson

Baker Donelson has added Kenya Parrish-Dixon as a shareholder in its commercial litigation group. She arrives from Nelson Mullins. For insights from Baker Donelson, see “Preparing for Potentially Expanded BIPA Exposure After the Meta Decision” (Oct. 14, 2026); and “How to Create a Program to Combat Deepfakes” (Oct. 22, 2025).

Ogletree Deakins Adds Cybersecurity, Data Privacy and AI-Focused Shareholder in San Francisco

Ogletree Deakins has welcomed Anne Yarovoy Khan to the firm’s San Francisco office as a shareholder. She arrives from Fisher Phillips. For insights from Ogletree Deakins, see our two-part series on navigating the interplay of E.U. data and AI laws: “Legal Landscape” (Oct. 14, 2026), and “Compliance Measures” (Oct. 21, 2026).

Most-Read Articles