2nd National Conference on Cybersecurity Law & Compliance - DS

EARN CLE CREDITS

2nd National Conference on

Cybersecurity LAW & COMPLIANCE January 29–30, 2025 • Hilton Towers Arlington, VA The only practical, comprehensive cybersecurity event for the legal and compliance community.

Key Enforcement Updates From: Eun Young Choi

Alejandro Rosenberg

Deputy Assistant Attorney General, National Security Division U.S. Department of Justice

Attorney, Division of Privacy and Identity Protection Federal Trade Commission

Terry Kalka

Laura D’Allaird

Co-Chief, Crypto Assets and Cyber Unit, Division of Enforcement U.S. Securities and Exchange Commission

2025 Co-Chairs: Joseph Whitehead

Senior Corporate Counsel, Cyber & Privacy Northrop Grumman Corporation

Charu Chandrasekhar

Partner Debevoise & Plimpton LLP Former Assistant Regional Director, SEC Division of Enforcement

Director DC3 DCISE

Benefit from legal, compliance, risk management and incident response strategies, including: The SEC DISCLOSURE RULE and MATERIALITY: Trends in Filings, Holding

Statements and the Aftermath

CASE STUDIES Led by Prudential and Marriott: Lessons Learned from a Cyber Breach EU CYBER COMPLIANCE: How to Satisfy DORA, NIS2 and More EU Requirements CRITICAL INFRAUSTRUCTURE Security and Resilience: Industry Requirements and

the Current Status of the CIRCIA Rule

BUSINESS CONTINUITY IN A CRISIS: Crafting the Message to the Board,

Employees, Media and Beyond

Supporting Sponsor

Premium Exhibitor

AI RISK AND THE INTERPLAY WITH CYBER: Implementing AI Policy with a Risk

Management Function

CYBER INSURANCE: The Lengths and Limits of Coverage, Cost and Privilege

REGISTER NOW

AmericanConference.com/Cyber-Security-Law • 888 224 2480

a C5 Group Company Business Information in a Global Context

With so much at stake, ensure your organization’s cyber program is fully incorporating (and reconciling) a complicated web of federal, state and international requirements.

Assess whether or not your organization is equipped to satisfy SEC, FTC and more agencies’ expectations.

Join ACI’s 2nd National Conference on Cybersecurity Law & Compliance Conference – the country’s only practical, comprehensive event for the legal and compliance community.

Learn from participating organizations, including: • Agricultural Bank of China, New York Branch • BAE Systems • Boeing • Cisco Systems

• Citigroup

• Prudential Financial

• Hudson Insurance Group

• RTX Corporation

• IBM

• Spire Global

• Marriott International

• Wells Fargo Bank

Benefits of attending: HEAR directly from government representatives about policy, compliance and enforcement actions GAIN the latest practical and actionable strategies for incident response LEARN how to vet third party business partners and secure your supply chain NETWORK with cross-sector corporate executives and benchmark with your peers

Accreditation will be sought in those jurisdictions requested by the registrants which have continuing education requirements. This course is identified as nontransitional for the purposes of CLE accreditation.

ACI certifies this activity has been approved for CLE credit by the State Bar of California.

ACI certifies this activity has been approved for CLE credit by the New York State Continuing Legal Education Board.

For more information on ACI’s CLE process, visit: www.AmericanConference.com/Accreditation/CLE

EARN CLE CREDITS

ACI has a dedicated team which processes requests for state approval. Please note that event accreditation varies by state and ACI will make every effort to process your request.

2 | LINKEDIN Defense, Aerospace & National Security: Legal, Regulatory, and Compliance Professionals

#CyberLaw

Faculty CONFERENCE CO-CHAIRS

Joseph Whitehead

Senior Corporate Counsel, Cyber & Privacy Northrop Grumman Corporation

Charu Chandrasekhar

Partner Debevoise & Plimpton LLP Former Assistant Regional Director, Division of Enforcement and Chief U.S. Securities and Exchange Commission GOVERNMENT SPEAKERS

Eun Young Choi

Deputy Assistant Attorney General, National Security Division U.S. Department of Justice

Alejandro Rosenberg

Attorney, Division of Privacy and Identity Protection Federal Trade Commission

Terry Kalka Director DC3 DCISE

Laura D’Allaird

Co-Chief, Crypto Assets and Cyber Unit, Division of Enforcement U.S. Securities and Exchange Commission

Jurgita Skritaitė

Senior cyber policy expert European Union Agency for Cybersecurity (ENISA)

Joseph Szczerba

Section Chief, Cyber Division Federal Bureau of Investigation (FBI) INDUSTRY REPRESENTATIVES

Billee Elliott McAuliffe

Member & Data Protection Practice Group Leader Lewis Rice LLC

Joanna Baltes

Chief Cybersecurity Counsel, Americas IBM

Guillermo S. Christensen Partner K&L Gates LLP

Michael Court

Deputy General Counsel Agricultural Bank of China, New York Branch

Eric J. Ellman

Senior Vice President, Public Policy and Legal Affairs Consumer Data Industry Association

Monique Ferraro Cyber Counsel HSB

Jonathan Gannon

Chief Cyber and Privacy Counsel, Chief Privacy Officer GE Vernova

Chris Hale

Senior Director and Associate General Counsel for Cyber and National Security Cisco Systems

Jocelyn J. Hunter

Vice President & Deputy General Counsel The Home Depot

Britt Ide

Board Director NorthWestern Energy, PowerGEM LLC, Technosylva

Ali Karshan

Global Head of Information Security and Incident Response Legal TikTok

David Kessler

Vice President & Associate General Counsel, IT & Cybersecurity BAE Systems, Inc.

Sonita Lontoh

Independent Board Director, Member of Audit and Compensation Committees Sunrun TrueBlue Inc.

Emily Lowe

Senior Vice President, Cyber Practice Leader Hudson Insurance Group

Christine Ricci

General Counsel, Global Security & Digital Technology GE Aerospace

Marc Rothenberg

Chief Legal Officer, Cybersecurity, Data Privacy, and AI Law Prudential Financial

Mike Serra

Senior Counsel for Cyber and National Security Cisco Systems, Inc.

Kimberly J. Shur

Amy Waller Apostol

Assistant General Counsel, Cyber & Emerging Technologies Legal Department Leidos

Alyson Weckstein Tiegel Assistant General Counsel, Cybersecurity Wells Fargo Bank

John J. Vecchione

Senior Litigation Counsel New Civil Liberties Alliance

PRIVATE PRACTICE FACULTY

John P. Carlin

Cybersecurity & Data Protection Practice Group Co-chair and Partner Paul, Weiss

Nathan D. Fisher Managing Director StoneTurn

Siobhan Gorman

Partner, Cybersecurity, Data & Privacy Global Lead Brunswick Group

Katherine Doty Hanniford Partner, Privacy, Cyber & Data Strategy Practice Alston & Bird LLP

David Hirsch

Partner McGuireWoods LLP Former Chief, Crypto Assets and Cyber Unit, Division of Enforcement U.S. Securities and Exchange Commission

Myriah V. Jaworski Member Clark Hill PLC

Sandeep Kathuria Senior Counsel Ice Miller LLP

Brian Levine

Managing Director, Cybersecurity & Data Privacy EY-Parthenon

David K. Lietz

Senior Partner Milberg Coleman Bryson Phillips Grossman, LLC

Senior Vice President, Global Compliance Counsel & Privacy Officer Marriott International Inc.

Amy S. Mushahwar

Sam Singer

Partner Cravath, Swaine & Moore LLP

Chief Counsel, Cyber Boeing

Viet C. Tran

Senior Director & Associate General Counsel, Cybersecurity RTX Corporation

Lynn M. van Buren Counsel Spire Global

Partner Lowenstein Sandler LLP

Evan Norris

Kimberly Peretti

Partner, Co-leader of the Privacy, Cyber & Data Strategy Team Alston & Bird LLP

Kenya Reddy

Attorney Morgan & Morgan Complex Litigation Group

Pre-Conference Workshops Tuesday, January 28, 2025

WORKSHOP A 9:00 am–12:30 pm (Registration opens at 8:30 am)

A Roadmap to Building a Cyber Program: Dissecting the Patchwork of Federal, State and Industry Requirements, Including NIST and SEC Join this interactive session to gain a complete roadmap to the patchwork of federal, state and industry regulations. Under the SEC’s newly adopted cybersecurity risk management rules, public companies are now required to disclose a cyber breach publicly and within four days. This session will unpack the requirements, grey areas, practical implications and key missteps to avoid: Part One: Federal Regulations • Setting the highest standard to satisfy government regulations and protect your organization

Michael Court

Deputy General Counsel Agricultural Bank of China, New York Branch

Amy S. Mushahwar

Partner Lowenstein Sandler LLP

• Implementing regulations and operationalizing them through policies and procedures • Clarifying key requirements, including deadlines • Satisfying SEC’s expectations for incident reporting within four days, and specifically the expectation for a Form 8-K and Form 10-K filing • Updating initial reports, and what is expected in follow-up reports • Defining a “material” cybersecurity incident as reaching a threshold reasonable investors consider important to their decision-making • Assessing the incident's effects, remediation efforts, cyber insurance impacts, and estimated costs of a breach Part Two: Complying with State, Federal and Industry Specific Requirements • Identifying what is being regulated, where there are similarities, differences and gaps between the regulations • Meeting reporting obligations and communicating to the different state regulators • Determining the impact of regulations on your business operations

WORKSHOP B

1:30–5:00 pm (Registration opens at 1:00 pm)

Tabletop Exercise: A Practical Step-by-Step Plan to Cyber Incident Response Join this interactive segment with hypothetical scenarios to work through expected and lesser-known scenarios, actions and outcomes.

Delve into the essential best practices and strategies for rolling out an effective action plan, and tackling hurdles to incident response: • Determining the response to an IT issue that doesn’t get raised to the board or senior management

Guillermo S. Christensen Partner K&L Gates LLP

Nathan D. Fisher Managing Director StoneTurn

» Identifying what a routine response looks like » Analyzing the hallmarks of an incident to measure severity and if it amounts to a crisis • Responding to a progressively more severe situation and ransomware demand » Recent examples of how (and how not) to respond to a ransomware demand » Examining what the company policy says, and how it may apply to different situations » Determining whether or not to pay or not pay ransomware • Communicating your company’s position when the event goes public » Analyzing how a cyber incident changes when it becomes public » How to respond when the company is a consumer facing business » Responding to media attention and scrutiny • Implementing a resiliency and redundancy plan » Implementing the full plan for crisis recovery » Defining what business continuity looks like-and what needs to change moving forward

4 | LINKEDIN Defense, Aerospace & National Security: Legal, Regulatory, and Compliance Professionals

#CyberLaw

Main Conference Day One Wednesday, January 29, 2025 7:45

Registration & Breakfast

8:45

Opening Remarks from the Co-Chairs Joseph Whitehead

Charu Chandrasekhar

Senior Corporate Counsel, Cyber & Privacy Northrop Grumman Corporation

9:00

Partner Debevoise & Plimpton LLP Former Assistant Regional Director, Division of Enforcement and Chief U.S. Securities and Exchange Commission

FIRESIDE CHAT: What May Be Eligible for a National Security Exception to the 4-Day SEC Deadline

This session will discuss the circumstances under which the U.S. government will grant an exception for a cybersecurity disclosure filing beyond the four-day deadline. AT&T made a delayed disclosure filing, due to “national security and public safety concerns,” in July 2024.

• Examining when and how the exception applies

Eun Young Choi

Deputy Assistant Attorney General, National Security Division U.S. Department of Justice

• Factors affecting the decision to grant an exception • How is AI being viewed as a risk and as a compliance tool-and the interplay with national security

9:30

EC Disclosure Rule and Materiality One-Year In: S Trends in the Number and Types of Filings, Holding Statements and the Aftermath

Join this session for a one-year review and status report on how the SEC disclosure rule is working in practice, the compliance expectations and challenges, and the lessons from the past year.

• Overview of what the SEC is seeing in terms of the number of filings, and trends in the numbers • Examining whether companies are satisfying compliance expectations and when companies could be showing more fulsome reporting • How many “holding statements” are being submitted to say that an incident has occurred, without saying whether it is “material” and how companies have determined materiality • How different industries have interpreted and applied the rule

Laura D’Allaird

Co-Chief, Crypto Assets and Cyber Unit, Division of Enforcement U.S. Securities and Exchange Commission

David Hirsch

Partner McGuireWoods LLP Former Chief, Crypto Assets and Cyber Unit, Division of Enforcement U.S. Securities and Exchange Commission

• The required level of detail in reporting

10:30

Networking Break

Media Partners

NAGC N AT I O N A L A S S O C I AT I O N O F GOVERNMENT CONTRACTORS

REGISTER NOW

AmericanConference.com/Cyber-Security-Law • 888 224 2480

a C5 Group Company Business Information in a Global Context

Main Conference Day One | Wednesday, January 29 11:00

Case Study: Lessons Learned from a Cyber Breach

Hear directly from organizations that have experienced a cyber breach and delve into the critical — and unexpected — steps that were taken to identify, communicate and mitigate the damage.

• Working with the FBI and other authorities • Examining the hack tactics, trends and how vulnerabilities are being exploited • Reviewing timelines of a breach, and lessons learned for prevention and incident response

Jocelyn J. Hunter

Marc Rothenberg

Vice President & Deputy General Counsel The Home Depot

Chief Legal Officer, Cybersecurity, Data Privacy, and AI Law Prudential Financial

Kimberly J. Shur

Evan Norris

Senior Vice President, Global Compliance Counsel & Privacy Officer Marriott International Inc.

Partner Cravath, Swaine & Moore LLP

12:00

Networking Luncheon

1:15

Cyber and Corporate Governance: Perspectives from Board Members on Priorities and Expectations

Join this session to learn more about board member cyber security priorities, how best to communicate cyber concerns to board members, and how companies need to interact with the board in accordance with the SEC disclosure rules.

Britt Ide

Sonita Lontoh

Board Director NorthWestern Energy, PowerGEM LLC, Technosylva

Independent Board Director, Member of Audit and Compensation Committees Sunrun TrueBlue Inc.

Brian Levine

Managing Director, Cybersecurity & Data Privacy EY-Parthenon

2:00

Moderated by: John P. Carlin

Cybersecurity & Data Protection Practice Group Co-chair and Partner Paul, Weiss

BUSINESS CONTINUITY

The Unspoken Rules for Maintaining Business Continuity in the Event of a Cyberattack or Disruption • Assessing how a cyber incident will impact business from a macro lens • Strategizing how the company will react to a cyber attack and ensuring policies are in place • Implementing non-tech reliant redundancy systems, and showing you can switch providers • Anticipating the impact on supply chains, vendors, partners and clients • Assessing the damage: Determining if you can continue to provide service, pay employees and perform other critical business functions • Implementing the necessary safeguards to protect from further damage and mitigate the risk of a future incident

Joanna Baltes

Chief Cybersecurity Counsel, Americas IBM

Monique Ferraro Cyber Counsel HSB

Amy Waller Apostol

Assistant General Counsel, Cyber & Emerging Technologies Legal Department Leidos

• Updating your disaster analysis and recovery plan • Strengthening your security safeguards and protocols

Envelope Join Our Email List to Stay Connected SIGN UP TO RECEIVE EXCLUSIVE DISCOUNTS, OFFERS AND PROGRAM UPDATES AmericanConference.com/join-our-email-list/

6 | LINKEDIN Defense, Aerospace & National Security: Legal, Regulatory, and Compliance Professionals

#CyberLaw

Main Conference Day One | Wednesday, January 29 3:00

Networking Break

3:15

ommunicating in a Crisis: Executing a Comprehensive Communication Plan and Controlling the C Message to the Board, Employees, Media and Beyond

• Controlling the message internally and externally to the government, to the public, to the board, employees, customers and clients » Responding to the government reporting agencies in a timely and accurate fashion » Proactively addressing what a hacker is saying about your company to the media » Getting the correct team of experts in front of the board to address questions

Ali Karshan

Global Head of Information Security and Incident Response Legal TikTok

Christine Ricci

• Documenting events for reporting purposes

General Counsel, Global Security & Digital Technology GE Aerospace

• Coordinating with law enforcement for the response and mediation

Kimberly Peretti

» Supporting employees who are being exploited by hackers

• Avoiding negative consequences of not communicating • Exploring how company culture impacts crisis communication

4:00

Partner, Co-leader of the Privacy, Cyber & Data Strategy Team Alston & Bird LLP

Cyber Insurance: The Lengths and Limits of Coverage from Cost, Scope and Privilege

• Delineating what insurance will and will not cover, including ransomware, property damage and political violence insurance • Considering options when ransomware is excluded from insurance • Identifying your company’s weak points and exposure, what insurance type is needed, and covering your assets • Calculating the cost of company exposure versus the affordability of insurance

Monique Ferraro Cyber Counsel HSB

Emily Lowe

Senior Vice President, Cyber Practice Leader Hudson Insurance Group

• Demystifying key provisions and exemptions in policies—and what they mean in practice • When to involve insurance brokers in privileged legal counsel discussions

4:45

Closing Remarks from the Conference Co-Chairs

Networking Cocktail Reception

Upcoming Events March 26–27, 2025 | San Francisco

REGISTER NOW

April 24–25, 2025 | Washington, DC

AmericanConference.com/Cyber-Security-Law • 888 224 2480

a C5 Group Company Business Information in a Global Context

Main Conference Day Two Thursday, January 30, 2024 8:30

Registration Opens

8:45

Opening Remarks from the Conference Co-Chairs Joseph Whitehead

Senior Corporate Counsel, Cyber & Privacy Northrop Grumman Corporation

8:50

Charu Chandrasekhar

Partner Debevoise & Plimpton LLP Former Assistant Regional Director, Division of Enforcement and Chief U.S. Securities and Exchange Commission

Special Update: Evolving Threat Actor Landscape, National Security Risks and Ransomware

• Examining the threat actor landscape, where the threats are coming from, how are they manifesting, and the impact on companies and business • Gauging the level and intensity of cyber attacks • Lessons learned from recent cyber incidents including: » Interactions with the hacking groups Scattered Spider and LockBit • What are government agencies doing to combat cyber attackers, and has it been effective? » Paying or not to paying ransomware: Key considerations, including when economic sanctions come into play

Joseph Szczerba

Section Chief, Cyber Division Federal Bureau of Investigation (FBI)

Moderated by: Katherine Doty Hanniford

Partner, Privacy, Cyber & Data Strategy Practice Alston & Bird LLP

» Negotiating with hackers: Best practices

9:15

EU CYBER COMPLIANCE

How to Satisfy DORA, NIS2 and More EU Requirements: Overcoming Hurdles to Implementation the U.S. The EU is leading the charge in cybersecurity and US companies need to be bracing for impact. This session will address current and incoming European legislation and regulations that will affect global businesses.

NIS2, The Network and Information Security (NIS) Directive, comes into effect October 2024, introducing more detailed incident reporting requirements and timelines.

• Identifying which sectors and companies will be expected to comply, such as cloud services and critical infrastructure • Outlining the reporting requirements The Cyber Resilience Act will affect companies selling into EU countries starting in 2027.

• Redesigning software to meet specification • Reporting vulnerabilities in your software

Siobhan Gorman

Partner, Cybersecurity, Data & Privacy Global Lead Brunswick Group

Chris Hale

Senior Director and Associate General Counsel for Cyber and National Security Cisco Systems

Jurgita Skritaitė

Senior cyber policy expert European Union Agency for Cybersecurity (ENISA)

DORA, the Digital Operational Resilience Act, will affect financial institutions and their technology suppliers as of January 2025 • Reducing risk service providers and third-party vendors • Meeting requirements for IT risk management and operational resiliency

8 | LINKEDIN Defense, Aerospace & National Security: Legal, Regulatory, and Compliance Professionals

#CyberLaw

Main Conference Day Two | Thursday, January 30 10:00 AI Risk and Policy-and the Interplay with Cyber:

Implementing AI Policy with a Risk Management Function Alejandro Rosenberg

• Surveying how the different U.S. states are regulating Artificial Intelligence, what provisions are being included and how companies need to be thinking about incoming regulations

Attorney, Division of Privacy and Identity Protection Federal Trade Commission

• Defining what is and what is not Artificial Intelligence—and how it can affect cybersecurity • Examining what kind of Artificial Intelligence your company already has—and what it needs to develop or acquire • Estimating your company’s AI risk tolerance and whether it is appropriate for your business

General Counsel, Global Security & Digital Technology GE Aerospace

• Setting up an AI oversight program • Implementing AI safeguards

Lynn M. van Buren

• Knowing how your third-party providers are using AI and how that may expose your company to cyber and other risk

Counsel Spire Global

• Examining the risk of becoming too dependent on an AI tool

Networking Break

11:00

THIRD PARTY MANAGEMENT

Vice President & Associate General Counsel, IT & Cybersecurity BAE Systems, Inc.

Christine Ricci

• Creating a policy and guidelines

10:45

David Kessler

Vetting Third Party, Business Partner and Supply Chain Cyber Controls: Assessing Risks and Vulnerabilities • Monitoring how your third-party providers are interacting with your data, what line of sight they have, and what is in your agreements • Benchmarking: What are market standards for third-party contracts and what does a conservative contract include (and not include) • Identifying which regulations will apply, how they overlap or differ, and to which vendor types • Determining how far to go in your third-party due diligence and risk assessment— from the legal and IT sides

Jonathan Gannon

Chief Cyber and Privacy Counsel, Chief Privacy Officer GE Vernova

Viet C. Tran

Senior Director & Associate General Counsel, Cybersecurity RTX Corporation

• Determining what is acceptable risk-and what is too much • Onboarding new vendors and evaluating the risk • Monitoring third party compliance • Determining if and when to terminate a third-party relationship

Global Sponsorship Opportunities

SUPPORTING SPONSOR

With conferences in the United States, Canada, Latin America and Europe, the C5 Group of Companies: American Conference Institute, Canadian Institute, and C5 Group, provides a diverse portfolio of conferences, events and roundtables devoted to providing business intelligence to senior decision makers responding to challenges around the world.

Our Privacy, Cyber & Data Strategy Team has been advising clients across the information lifecycle since the mid-1990s. Our team features leading practitioners in the areas of greatest challenge for business today, a detailed and practical approach to solving problems and managing crises, and a commitment to delivering excellence for our clients. We help clients with privacy, cybersecurity, and national security issues in the U.S. and across the globe.

Don’t miss the opportunity to maximize participation or showcase your organization’s services and talent. For more information please contact us at: SponsorInfo@AmericanConference.com

REGISTER NOW

AmericanConference.com/Cyber-Security-Law • 888 224 2480

a C5 Group Company Business Information in a Global Context

Main Conference Day Two | Thursday, January 30 ritical Infrastructure Security and Resilience Policy: C The Industry Requirements and the Current Status of the CIRCIA Rule

11:45

The Cybersecurity and Infrastructure Security Agency (CISA) requires covered entities to report cyber incidents and ransomware payments under the Cyber Incident Reporting for Critical Infrastructure Act (2022) (CIRCIA).

Terry Kalka

Director DC3 DCISE

Sam Singer

Chief Counsel, Cyber Boeing

This session will examine how cyber should be incorporated into critical infrastructure security and resilience policy. The current policy covers 16 critical infrastructure sectors, which are considered vital to US security, national economic security and national public health or safety.

• Adhering to CISA reporting timeframes • Identifying which business categories are captured • Defining “critical infrastructure,” how it applies to different sectors and how it may be redefined under updated policy • Examining CISA’s role to support state and industry partners • Identifying essential workers needed to maintain services and functions for the public • Hypothesizing potentially debilitating national security, economic, public health or safety consequences of a cyber breach and safeguarding against this possibility • Clarifying reporting requirements following a breach

12:30

Networking Luncheon

1:30

Q&A State Legislative Panel on Cyber and Privacy Updates

Hear directly from state legislative representatives as they discuss how cybersecurity measures are being incorporated into state laws. Learn how state laws work in concert with federal laws and regulations, and where there are gaps.

Join this interactive Q&A session.

2:00

Eric J. Ellman

Senior Vice President, Public Policy and Legal Affairs Consumer Data Industry Association

Billee Elliott McAuliffe

Member & Data Protection Practice Group Leader Lewis Rice LLC

Striking Down the Chevron Doctrine: How the Supreme Court and Lower Courts Will Now Be Approaching Legal Interpretation—and the Impact on Cyber Compliance

The U.S. Supreme Court issued a landmark decision in Loper Bright Enterprises v. Raimondo (2024) overturning Chevron USA v. National Resources Defense Council (1984) and the federal judiciary’s standing practice of accepting government agencies’ reasonable interpretations of ambiguous federal laws.

This session will delve into what this precedent-setting decision will mean for government agencies regulating the cyber space.

Myriah V. Jaworski

Member Clark Hill PLC

John J. Vecchione Senior Litigation Counsel New Civil L iberties Alliance

• Unpacking the practical impact of the Supreme Court decision on cybersecurity compliance • Calculating how much authority government agencies now have in the eyes of the courts

The C5 Group, comprising American Conference Institute, the Canadian Institute and C5 in Europe, is a leading global events and business intelligence company.

For over 40 years, C5 Group has provided the opportunities that bring together business leaders, professionals and international experts from around the world to learn, meet, network and make the contacts that create the opportunities.

Our conferences and related products connect the power of people with the power of information, a powerful combination for business growth and success.

10 | LINKEDIN Defense, Aerospace & National Security: Legal, Regulatory, and Compliance Professionals

#CyberLaw

Main Conference Day Two | Thursday, January 30 2:45

Networking Break

3:00

CASE STUDIES: Practical Takeaways from the Most Significant Security Incidents Alyson Weckstein Tiegel

Salt Typhoon attack • Hackers targeted phones and listened in on conversations.

• Including Donald Trump, JD Vance, Kamala Harris campaign workers and State Department officials.

• Hackers acquired access to the system that logs U.S. law enforcement requests for criminal wiretaps.

Assistant General Counsel, Cybersecurity Wells Fargo Bank

Sandeep Kathuria Senior Counsel Ice Miller LLP

BeyondTrust attack • Chinese hackers were able to remotely access certain unclassified documents on Treasury Departmental Offices user workstations.

• The hackers compromised third-party cybersecurity service provider BeyondTrust.

• Also breached the Office of Foreign Assets Control (OFAC) as well as the Office of the Treasury Secretary.

Crowdstrike Software Update Not a cyberattack, but the July 2024 software update caused widespread concerns and business disruption.

• Defining what is considered a cyber incident, what is material and what is filed in the 8K • Delineating fault when there is a business disruption, recouping costs and indemnification • How is this treated under the cybersecurity rule Change Healthcare and Optimum Attack • The healthcare technology company Change Healthcare experienced a cyberattack, affecting millions of customers, in February 2024 SolarWinds and Lawsuit against CISO • The Security and Exchange Commission has charged the SolarWinds CISO with fraud and internal control failures relating to a cybersecurity risk • Exploring the extent of personal liability • Testing how companies are presenting themselves as secure, and is the company doing what is advertised ICBC Cyberattack • Exploring business continuity in the midst of an attack and business resiliency Microsoft-Related GDPR Violation A Microsoft-owned advertising company, Xandr, is accused of a EU privacy breach under General Data Protection Regulation (GDPR) rules.

• Controlling subsidiaries and the reputational risk • Examining the EU GDPR complaint process and possible fines

3:45

PLAINTIFF ATTORNEY PANEL

Perspectives from Plaintiff Attorneys and Takeaways from Recent Cases • Trends in litigation and new, emerging types of cases • Approaching a lawsuit from the plaintiff’s perspective • Examining what steps companies can take to minimize litigation risk and liability • Preparing and responding to litigation • Clarifying where liability may be for an individual vs. the company

Kenya Reddy

Attorney Morgan & Morgan Complex Litigation Group

David K. Lietz

Senior Partner Milberg Coleman Bryson Phillips Grossman, LLC

4:30 Closing Remarks by the Conference Co-Chairs

Conference Concludes

REGISTER NOW

AmericanConference.com/Cyber-Security-Law • 888 224 2480

a C5 Group Company Business Information in a Global Context

VENUE INFORMATION

Hilton Arlington Towers 950 North Stafford Street Arlington, VA 22203 Phone: 1-800-445-8667

ACCOMMODATIONS American Conference Institute is pleased to offer our delegates a limited number of hotel rooms at a negotiated rate.

To take advantage of these rates, please contact the hotel directly and quote the group code “CYL.” Please note that the guest room block cut-off date is December 27th, 2024. After that date OR when the room block fills, guestroom availability and rate can no longer be guaranteed.

BOOK NOW

WORRY FREE Registration

GUARANTEE

Book with Confidence!

Register and pay to lock in your early rate and be eligible for a full refund until January 15th, 2025.

If you are unable to attend for any reason, you will have the following options: y A full credit note for you, or a colleague to attend another event. y A full refund.

All cancellations and changes must be submitted to CustomerService@AmericanConference.com

by January 15th, 2025.

Yanette Ching American Conference Institute

Looking to Register?

Contact our Customer Service Representatives:

Gonzalo Dounis American Conference Institute



Y.Ching@AmericanConference.com



G.Dounis@AmericanConference.com



1 212 352 3220 x5499



1 212 352 3220 x7536

Use Registration Code: B00-999-YCG25

PRICING

Use Registration Code: B00-999-GDS25

Register & Pay by October 18, 2024

Register & Pay by January 10, 2025

Register & Pay after January 10, 2025

$2,195

$2,495

$2,595

CONFERENCE CODE:

677L25-WAS

Conference Only

Bringing a Team?* Workshops

$600 each

All program participants will receive an online link to access the conference materials as part of their registration fee.

Additional copies of the Conference Materials available for $199 per copy.

To update your contact information and preferences, please visit https://www.AmericanConference.com/preference-center/.

Terms & conditions and refund/cancellation policies can be found at AmericanConference.com/company/faq/

1–3

No Discount

4–8

10% Conference Discount

9–12

15% Conference Discount

12+

Call 888-224-2480

* Team/group registrations must be from the same organization/firm and register together in one transaction.

Special Discount

© American Conference Institute, 2024

ACI offers financial scholarships for government employees, judges, law students, non-profit entities and others. For more information, please email or call customer service.