Latest / Committed Capital / Managing Cybersecurity Risk in Private Equity Transactions: Investing in the Modern Age

Transcript

Managing Cybersecurity Risk in Private Equity Transactions: Investing in the Modern Age · Committed Capital

• 0:08
  Intro: Welcome to Dechert's Committed Capital, where PE leaders open their playbooks to discuss today's PE trends.
• 0:18
  Brenda Sharton: Hi everybody.
• 0:19
  Brenda Sharton: I'm Brenda Sharton.
• 0:20
  Brenda Sharton: I'm a litigation partner and co-chair of Dechert's global privacy and cybersecurity practice.
• 0:26
  Brenda Sharton: In this episode, we'll be talking about cybersecurity and its importance for private equity investors.
• 0:32
  Brenda Sharton: I'm joined today by two experts in this area.
• 0:36
  Brenda Sharton: First Jessica Pizzo, who is a resource partner focused on technology, security and digital transformation at our client Court Square Capital.
• 0:46
  Brenda Sharton: And second, John Ansbach.
• 0:49
  Brenda Sharton: He serves as a vice president and engagement partner at Stroz Friedberg, a global forensic firm.
• 0:56
  Brenda Sharton: Jessica, maybe you could start and tell us a little bit about your background and what you do at Court Square.
• 1:01
  Jessica Pizzo: Sure.
• 1:02
  Jessica Pizzo: Thanks, Brenda.
• 1:03
  Jessica Pizzo: I'm Jessica Pizzo, a resource partner at Court Square Capital Partners.
• 1:07
  Jessica Pizzo: We are a New York- based mid-market private equity firm.
• 1:10
  Jessica Pizzo: Our managing partners have invested roughly US$14 billion of capital over almost 40 years.
• 1:15
  Jessica Pizzo: As a member of the resource team, I cover the technology function throughout the life cycle of our investments, starting with technology and cybersecurity due diligence, driving technology transformation, and risk mitigation through our value creation plans and generally supporting our IT leaders throughout our holds period.
• 1:31
  Jessica Pizzo: It's a pleasure being here today.
• 1:32
  Jessica Pizzo: Thanks for having me.
• 1:34
  Thanks for being here with us and, John, we've worked an awful lot together, but if you wouldn't mind, telling folks with you do at Stroz Friedberg.
• 1:44
  John Ansbach: Sure, Brenda, thank you so much.
• 1:45
  John Ansbach: Hello everybody, John Ansbach here with Stroz Friedberg.
• 1:48
  John Ansbach: We're an Aon company.
• 1:49
  John Ansbach: We are in about 11 offices in North America, US and Canada, four more offices overseas, servicing UK and EU, and certainly APAC.
• 2:01
  John Ansbach: My job at Stroz, I am what's called an engagement manager.
• 2:04
  John Ansbach: I lead complex digital forensic and incident response projects.
• 2:10
  John Ansbach: I spend probably 70% plus of my time helping companies to address incidents, and then the remainder of my time I spend helping them to either build a resilience against attacks, proactively or to help in the assessment of M&A transactions, certainly acquisitions, all with regard to cyber due diligence, you know.
• 2:31
  John Ansbach: Past life: I was a trial lawyer for about 10 years, and general counsel and chief legal officer for 10 years after that.
• 2:37
  John Ansbach: So do a lot of work in helping folks to stay out of trouble with cyber risk and certainly to address it when it comes up.
• 2:44
  John Ansbach: So very happy to be here today.
• 2:46
  Brenda Sharton: Thanks for being here as well, John.
• 2:49
  Brenda Sharton: First, I just want to spend just a couple of minutes talking about why private equity firms need to care about cybersecurity.
• 2:56
  Brenda Sharton: Having done this since the late 1990s, dealt with data breaches for clients, I can tell you that 2020 and into 2021 has been utterly unprecedented.
• 3:08
  Brenda Sharton: Every single year, the threat actors have increased their attacks in both sophistication and frequency, but nothing like we saw among our client base in 2020, largely due to the start of COVID.
• 3:22
  Brenda Sharton: And it was about March where we noticed that we were on average, had been doing about one to two data breaches a week for our clients.
• 3:31
  Brenda Sharton: And it just shot up exponentially to three to five times that rate.
• 3:35
  Brenda Sharton: Hackers love a good crisis.
• 3:38
  Brenda Sharton: But this is really an all-out war as phishing emails have shot up 35 times in 2020 from previous amounts.
• 3:47
  Brenda Sharton: And as hackers have grown in sophistication on the phishing emails, as well as the types of data that they're looking for.
• 3:56
  Brenda Sharton: So if you think about the old type of data breach, I like to say that these are not your grandfather's data breaches.
• 4:03
  Brenda Sharton: Gone are the days where they're looking at retailers or, you know, sort of credit card numbers.
• 4:09
  Brenda Sharton: Those still happen, but now what you need to be on alert for as an investor and with portfolio companies are the threat actors are looking at IP, they're looking at IP to use, they're looking at IP to exfiltrate and hold you ransom in increasingly large amounts of ransom in the multi-million dollar ranges.
• 4:31
  Brenda Sharton: And also, they're looking to intercept your wiring instructions, your closing amounts, or closing funds that are coming through.
• 4:40
  Brenda Sharton: They're looking to intercept those, and nation States are looking for data, and all of these things cause risk as an investor.
• 4:50
  Brenda Sharton: And we're going to talk today about some of those risks on liability from regulators and risks going into deals, if you're not assured and comfortable that the practices of the company that you're targeting are up-to-date, and state-of-the-art.
• 5:07
  Brenda Sharton: So, one of the things that we're going to try to do today for you is to talk about practical tips at different stages.
• 5:16
  Brenda Sharton: And so, we'd like for you to come away today with a lot of good takeaways, but I'm going to start with Jessica and best practices going into a new deal.
• 5:27
  Brenda Sharton: So Jessica, what are the things investors should consider doing and asking in diligence to be sure they are reducing the cyber risk going into an investment?
• 5:37
  Jessica Pizzo: Okay, thanks, Brenda.
• 5:38
  Jessica Pizzo: First I'll talk about best practices and the way that we think about structuring up cybersecurity diligence.
• 5:44
  Jessica Pizzo: And I think that this is an interesting topic because in order to accurately and thoroughly cover cybersecurity diligence, it actually runs across a couple of different traditional diligence work streams that would typically think, cybersecurity diligence within your broad technology diligence, where there are key security components to consider when reviewing a company's existing infrastructure, such as whether they're cloud-based or on-premise and assessing the overall ecosystem hygiene, a thorough cybersecurity diligence.
• 6:16
  Jessica Pizzo: We'll also dig into what we call security operations, which may not have been in scope in prior years before we saw this uptick that Brenda talked about.
• 6:24
  Jessica Pizzo: So that's really the people, the process and the tools that wrap around your applications and infrastructure to actively manage your security posture, but more expansively, when we're thinking about cyber security diligence, we also have to think about our legal diligence perspective.
• 6:40
  Jessica Pizzo: So what are the privacy regulations that a company is subject to, such as GDPR or CCPA and how has the technology team accommodated that compliance?
• 6:50
  Jessica Pizzo: Are there contractual obligations around security, such as a SOC two requirement from a customer or a BAA under HIPAA?
• 6:57
  Jessica Pizzo: And once again, how is technology and ops ensuring alignment with all of those terms?
• 7:02
  Jessica Pizzo: The next part of diligence that touches cybersecurity is insurance diligence.
• 7:06
  Jessica Pizzo: So folks should also be looking at whether a company has cyber insurance and if so, are they carrying the appropriate limits and scope of coverage since not all plans run that potential gamut of cyber challenges that an organization could encounter.
• 7:21
  Jessica Pizzo: And finally, ESG diligence also touches on cyber security.
• 7:26
  Jessica Pizzo: It can help to connect the dots between the technology and legal diligence work streams, as I mentioned.
• 7:31
  Jessica Pizzo: But it is specifically viewing your cybersecurity risks from social responsibility lens, turning our attention to the questions that we should be asking during diligence and how we would reduce our cyber r isk candidate.
• 7:43
  Jessica Pizzo: And the types of things that I look at when assessing a security posture, again, run across a broad spectrum.
• 7:51
  Jessica Pizzo: So how security-oriented i s the executive team?
• 7:54
  Jessica Pizzo: Is there any form of governance or executive support of their cyber posture outside of the technology team?
• 7:59
  Jessica Pizzo: So my experience cross-functional collaboration is key to being able to manage your cyber r isk, especially with the pace of change that we've seen recently, organizations have to be agile and responsive to new challenges, and you need a structure in which to do that.
• 8:13
  Jessica Pizzo: Then we're of course, looking at your more traditional technology components.
• 8:16
  Jessica Pizzo: So what's the capability of the infrastructure and security teams to deliver on a robust security posture.
• 8:22
  Jessica Pizzo: What's the quality of the architectural design across both infrastructure and applications and what tools and services d o they have in place to manage their security operations and what is the quality and breadth of their technical c onsults.
• 8:34
  Jessica Pizzo: And finally, and it's just an operational point, feeding these identified opportunities into a post-close plan to track down to resolution is obviously most important component here.
• 8:45
  Jessica Pizzo: I just mentioned a number of different diligence w ork s treams that are going to be spitting out opportunities to you i n a number of different questions being asked.
• 8:53
  Jessica Pizzo: So, you know, having a strong governance process over your cybersecurity diligence that feed into that post-close plan i s something that w ill certainly make this easier to address.
• 9:06
  Terrific.
• 9:07
  Thank you, Jessica.
• 9:09
  John, you've had private equity firms come to Stroz Friedberg to kick the tires as they're considering investments.
• 9:16
  What are the types of things you're being asked to do?
• 9:21
  John Ansbach: So we do, especially maybe in the last 12 to 18 months, we've had a lot of folks come to us sometimes with the deal about to close imminently.
• 9:29
  John Ansbach: Unfortunately, we get that request a lot.
• 9:32
  John Ansbach: Sometimes we're allowed to participate a bit earlier, but regardless of timing, the request as you'd expect is pretty straightforward, right?
• 9:39
  John Ansbach: We want to understand the cybersecurity risk associated with the investment or the target.
• 9:44
  John Ansbach: This is going to be about, you know, have they had incidents in the past themselves?
• 9:49
  John Ansbach: How are they presently set?
• 9:50
  John Ansbach: Do they have a cyber risk program, an IR program.
• 9:54
  John Ansbach: And so we can do, you know, a number of different things.
• 9:57
  John Ansbach: And this is the conversation that we generally have with folks, right.
• 10:00
  John Ansbach: On a leaner or lighter side of that scale, probably sort of three tiers, if you will, there's sort of tier one non-intrusive external analysis, right?
• 10:10
  John Ansbach: If you think of this more as a red flag, a review, we do this without any help from the target or from the investment.
• 10:17
  John Ansbach: We do external technical metrics, right?
• 10:19
  John Ansbach: We're looking at an assessment of publicly visible, active, historic cyber risks and events.
• 10:25
  John Ansbach: We have a threat intelligence group that will conduct threat intel, deep, dark web searches and analysis, looking for things like stolen data, stolen IP, credentials that are loose or in the wild, certainly with regard to executives that are in the investment, or, you know, we're looking for any information on executive compromise, and then sort of some cyber quantification modeling, if you will, where we would actually simulate the financial impact of a cyber attack on the target.
• 10:55
  John Ansbach: So company says, you know, we want to invest here or acquire this particular group, what would happen to them if they did suffer a ransomware attack by way of example, or a large scale of phishing attack, what's the implications for them in their current posture.
• 11:11
  John Ansbach: So that's a pretty light touch, frankly.
• 11:13
  John Ansbach: And again, no involvement of the target.
• 11:16
  John Ansbach: Tier two would be a bit more collaborative and comprehensive, right?
• 11:20
  John Ansbach: And we just sort of think of this as a comprehensive assessment, really true cyber due diligence.
• 11:25
  John Ansbach: If you will, here, we're identifying cyber risks that that would impact the target's operations.
• 11:31
  John Ansbach: We're looking at their technology, their platforms, their operations, we're talking data, regulatory assessment here, looking at operational and tech level compliance.
• 11:40
  John Ansbach: And then oftentimes looking at, you know, the remediation plan with associated costs.
• 11:44
  John Ansbach: So the firm can plan accordingly, right?
• 11:46
  John Ansbach: They may want to say, okay, well even if, even if the target's not well positioned right now, what's it going to take to get them from where they are to a more mature and resilient posture.
• 11:55
  John Ansbach: And so we can help to put some meat on that for their planning.
• 11:59
  John Ansbach: And then finally the last place where we are able to help.
• 12:02
  John Ansbach: And again, this is certainly intrusive and highly collaborative with the target, is enhanced cyber due diligence, likely during any exclusivity period, of course, and here we're talking about, things like penetration testing, vulnerability scanning, made to be, and have from time to time been called to look at source code, due diligence around a particular target of a varied product or service.
• 12:25
  John Ansbach: So it really ranges.
• 12:26
  John Ansbach: And that's the conversation we have is, look, what do you know about them so far?
• 12:30
  John Ansbach: What do you need to know?
• 12:31
  John Ansbach: What's possible to know given the collaboration and the sort of dynamics of the deal, and then we find a way to help answer those questions about how are they set and what's been their history, and that's a good conversation to have to really provide some insight.
• 12:46
  Brenda Sharton: That's terrific, John and I know the threat hunts and the deep dark web searches are helpful.
• 12:51
  Brenda Sharton: Not only in the context that you mentioned, but also for companies that are concerned after they've had an incident, or I know you even had a lot of, uh, companies that were treating COVID and the migration to the work from home environment that has caused the cyber attacks to go up exponentially treated that as an event and had a threat hunt done.
• 13:14
  John Ansbach: You're absolutely right about that.
• 13:15
  John Ansbach: Last March, obviously lots of companies moved, uh, if not the entire workforce to go remote, certainly large portions.
• 13:23
  John Ansbach: And in and of itself that prompted a lot of our clients to do threat hunts, to say, look, with a new environment, new technology deployed on mass, let's just be sure, and almost kick the tires ourselves to be sure that we're in a good place.
• 13:36
  John Ansbach: And so we ended up doing quite a bit of that work last year, and certainly that's continued into this year.
• 13:41
  John Ansbach: We'll continue to certainly around the pandemic.
• 13:44
  Brenda Sharton: Yes, it's ironic.
• 13:45
  Brenda Sharton: I think most companies expected a worst case scenario would be any computer virus would kick everybody off their systems.
• 13:53
  Brenda Sharton: And what happened instead is a human virus brought everybody onto the systems at the same time and, you know, getting onto the network from home and all kinds of cyber risk was created in 2020.
• 14:04
  Brenda Sharton: And we've seen that continuing to 2021.
• 14:09
  Brenda Sharton: So Jessica owning the company, right?
• 14:11
  Brenda Sharton: The closing has occurred.
• 14:13
  Brenda Sharton: The private equity firm owns the company.
• 14:15
  Brenda Sharton: Now we know from experience in our practice that right after the investment is a very critical time, especially if a press release has gone out as threat actors, see that, try to capitalize on that, try to take advantage of disruption, actors love any crisis or disruption.
• 14:32
  Brenda Sharton: What are some of the critical steps firms should consider taking right after the closing to reduce risk?
• 14:41
  Jessica Pizzo: So there's almost a limitless amount of effort that can be spent to secure an environment.
• 14:46
  Jessica Pizzo: So to me, this is one of the more difficult questions to answer in cybersecurity.
• 14:51
  Jessica Pizzo: And before I kick off, I've got kind of a short list of items that I run through post-close, but it really also just depends on the existing posture of the company coming in, as well as the business risk inherent in that organization.
• 15:07
  Jessica Pizzo: So not every company is going to need to be Fort Knox.
• 15:10
  Jessica Pizzo: It's a matter of taking lists like these, cultivating what makes sense for your particular industry and risk profile and then kind of picking from the list.
• 15:19
  Jessica Pizzo: So the first thing I usually hit is cybersecurity insurance.
• 15:22
  Jessica Pizzo: I do believe that every company should endeavor to carry some level of cybersecurity insurance of whatever's appropriate for their risk profile and size.
• 15:31
  Jessica Pizzo: Generally it should be relatively low effort to put in place, but your ability to secure or enhance your cybersecurity insurance will be impacted by the overall strength of your security posture.
• 15:42
  Jessica Pizzo: So depending on what was found in diligence, you may want to do this as your first step, or you may want to go through one of these other couple of these other five items and improve your security posture before going back out to market and quoting and securing cybersecurity insurance.
• 15:58
  Jessica Pizzo: So moving more into the technology operations side, uh, the second thing that I always look at top of my list is multi- factor authentication.
• 16:08
  Jessica Pizzo: And this measure was historically seen as introducing business friction for folks, and it wasn't always viewed as intuitive or easy to roll out, but considering that most folks are interacting with multi-factor authentication, it's become a lot easier to roll out in the business context.
• 16:24
  Jessica Pizzo: And it's really good bang for your buck because the phishing attacks have only gone up with COVID as we've touched on.
• 16:32
  Jessica Pizzo: So this is really the only way that you can protect your end users from someone who is not them coming into the system, as them related to that point, we should train our end users and regularly send out phishing tests.
• 16:47
  Jessica Pizzo: There's a number of vendors out there that will do this on your behalf for, you know, relatively reasonable costs.
• 16:54
  Jessica Pizzo: So that can also be a quick hit to just start getting folks trained if they're not being trained and start sending out those phishing tests to see who clicks, who downloads, who enters their password.
• 17:06
  Jessica Pizzo: So you get a sense of the overall intelligence of the end user base at an organization and sort of how far you have to go before you'll have a security savvy organization, if you will.
• 17:19
  Jessica Pizzo: The next, and this is a little bit more technical, but it's upgrading your antivirus software to endpoint detection and response, which you'll hear technologists refer to as EDR.
• 17:30
  Jessica Pizzo: But the big difference between these technologies just in layman's terms is that an antivirus software simply compares potential activities and your environment to static lists of known threats that are updated on a periodic basis.
• 17:46
  Jessica Pizzo: And as you can imagine, necessarily impossible to keep.
• 17:49
  Jessica Pizzo: So what EDR does is it utilizes intelligence to analyze and halts potentially malicious activities in your environment based on behavior that would be expected or not expected.
• 18:01
  Jessica Pizzo: But, so this is one of the key tools that we're currently using out thereto protect an organization.
• 18:06
  Jessica Pizzo: It's not a quick hit, as far as implementation.
• 18:09
  Jessica Pizzo: EDR can take a little bit of effort, a little bit of lift to get into place.
• 18:13
  Jessica Pizzo: But it's a couple of months that is well-spent at the beginning of an investment.
• 18:19
  Jessica Pizzo: The fifth item on my list is monitoring because we cannot secure what we're not watching.
• 18:26
  Jessica Pizzo: And I will add that inherent to monitoring is inventorying everything that needs to be monitored because we can't secure, or we don't know to watch.
• 18:35
  Jessica Pizzo: So this can be a bit higher effort if you're going to take this on internally, you'd need to select a security event and incident management tool, as well as staff for folks that would watch for the logs coming out of that tool.
• 18:49
  Jessica Pizzo: I'm personally a fan of mid-market companies outsourcing this function, and those vendors will be able to help you with figuring out what your full inventory is and what needs to be monitored.
• 19:00
  Jessica Pizzo: And they can also provide you with resources to watch those logs once it's been set up on a 24/7 basis.
• 19:07
  Jessica Pizzo: And then finally, the last item on my punch list is going back to overall governance and executive buy-in.
• 19:14
  Jessica Pizzo: Security professionals need that governance framework to operate within that gives them access and input to executives.
• 19:22
  Jessica Pizzo: And sometimes depending on the level of risk in that organization, the board level stakeholders as well, but to drive change within operating units, outside of technology, that security team needs support from those stakeholders.
• 19:37
  Jessica Pizzo: And oftentimes we'll need the funding support from those stakeholders as well.
• 19:41
  Jessica Pizzo: So I think ultimately the key takeaway here is that the security function can not operate on an island and still be effective.
• 19:50
  Brenda Sharton: That's kind of great advice, Jessica, thank you so much.
• 19:53
  Brenda Sharton: And did you hear that everybody?
• 19:54
  Brenda Sharton: You've got to spend money, it's going to be now or it's going to be later.
• 19:58
  Brenda Sharton: So you've got to fund that, the IT and cybersecurity program at the company.
• 20:03
  Brenda Sharton: I will say out of all the things you said, and I say this every time, anytime I can give a public service announcement, if you remember nothing else from this podcast, please go back and check and make sure you have multi-factor authentication on every company account.
• 20:22
  Brenda Sharton: These very ubiquitous business, email compromise attacks, which are you know, by far, the most prevalent, are sorted with multi- factor authentication.
• 20:33
  Brenda Sharton: That's the one where you get a phishing email.
• 20:35
  Brenda Sharton: They dupe you into putting in your credentials.
• 20:37
  Brenda Sharton: You'd be surprised at how good they are.
• 20:40
  Brenda Sharton: And then suddenly they're in the inbox and they're monitoring for wiring instructions and payments.
• 20:45
  Brenda Sharton: And there's fake vendor invoices.
• 20:47
  Brenda Sharton: We've seen a lot of money flow out of companies on those.
• 20:51
  Brenda Sharton: Make sure that anybody who's in a position in the company or your accounts payable team, your finance teams, all know you never, ever pay on a changed wiring instruction in an email that the hackers are getting.
• 21:06
  Brenda Sharton: They're, just really, the number of times in 2020, we've said we've never seen this before, and we're seeing this for the first time.
• 21:13
  Brenda Sharton: They are now picking up the phone, they know, okay.
• 21:17
  Brenda Sharton: They'll say in the email,"John, I know you need a phone call to change the wiring instructions.
• 21:21
  Brenda Sharton: So John, we'll give you a call." And the hackers picked up the phone and called and said,"just want to verify we're changing this." So you've got to have your accounts payable folks understand that they have to call on the contact information that's in the company files.
• 21:37
  Brenda Sharton: And then also cyber insurance.
• 21:39
  Brenda Sharton: So key and it's changed recently.
• 21:42
  Brenda Sharton: If you haven't looked at it, the time to negotiate it is before you have an event and you want to make sure that it's covering ransom.
• 21:49
  Brenda Sharton: And I know John, that will be a good segue.
• 21:53
  Brenda Sharton: The ransoms have gotten much, much higher.
• 21:56
  Brenda Sharton: We've been negotiating this year, several multimillion dollar ones.
• 22:01
  Brenda Sharton: Okay, John, what could possibly go wrong?
• 22:04
  Brenda Sharton: Let's assume now there's been an attack.
• 22:07
  Brenda Sharton: Usually Friday nights, holiday, weekends, and you and I both know.
• 22:11
  Brenda Sharton: John and I spent Memorial Day weekend this year, we spent Christmas Eve and New Year's Eve negotiating multimillion dollar ransom with Bulgarian hackers.
• 22:19
  Brenda Sharton: So they, usually, the hackers like to do this on a time where they think people are paying less attention, but let's talk John about some of the best practices during a breach, some of the biggest mistakes we see and some of the best practices once the attack has occurred.
• 22:37
  John Ansbach: Right.
• 22:38
  John Ansbach: And if I can really quickly, I'll second Jessica's comment about about MFA.
• 22:43
  John Ansbach: But so Brenda, since you added yours, let me third, that so much of the work that we do starts with email compromise.
• 22:48
  John Ansbach: So cannot suggest that enough, you know, when it comes to breach response and I'll use the B-word'cause we do a lot of data breach as well as security incidents.
• 22:56
  John Ansbach: They are essentially like jumping on a moving train.
• 22:59
  John Ansbach: If you will, when folks call us, they're sometimes somewhat panicky, even the most sophisticated response teams, you know, people are nervous.
• 23:08
  John Ansbach: They're concerned, has data gone out the door, the people we're talking to are concerned about, is this going to cost me my job?
• 23:15
  John Ansbach: There's a lot on the line when we arrive.
• 23:17
  John Ansbach: And so what we try to do right, is to bring a sense of coordination, of being deliberate to that response of getting everybody on the same page.
• 23:25
  John Ansbach: You know, when I think about sort of the best practices, if you will, obviously being timely in the response and notification is key.
• 23:32
  John Ansbach: Most of our clients, when they need to ring the bell, they do.
• 23:36
  John Ansbach: We occasionally have someone that says, gosh, you know, we had this thing happen a month ago.
• 23:39
  John Ansbach: And we're just starting to worry about it.
• 23:43
  John Ansbach: You know, a lot of times the ship has sailed on logs.
• 23:46
  John Ansbach: And so we really do depend on a timely response to get legal involved, to get the insurance folks involved, to get forensics involved.
• 23:53
  John Ansbach: That's clearly a best practice.
• 23:55
  John Ansbach: It's just being prompt.
• 23:57
  John Ansbach: Established partners is another area where we see people successful as opposed to not in incident response.
• 24:04
  John Ansbach: And by that, I mean, having a previously established relationship with a forensics firm like ours or another, obviously having a previously established relationship with your outside counsel, you've got insurance.
• 24:16
  John Ansbach: So that's critically important and can contribute to the success of a response.
• 24:22
  John Ansbach: The only other thing I might add to this is, and you and I have talked about this in the past, avoid blame in these early conversations.
• 24:31
  John Ansbach: We do, sometimes get on a call, we're trying to work the problem.
• 24:34
  John Ansbach: And there's always somebody on, maybe it's a CEO that wants to know first and foremost, I want to know how this happened.
• 24:40
  John Ansbach: I want to know how this happened, and there's going to be a time for that discussion.
• 24:45
  John Ansbach: But when we're in the middle of trying to coordinate a response for a portfolio company or anybody else, we've got to get containment, we got to get logs, we've got to get things going, and we will ultimately help to answer that question.
• 24:59
  John Ansbach: But if the IT professionals we're working with are looking over their shoulder the whole time, we can't get there.
• 25:05
  John Ansbach: So just a couple of things in my head that, you know, when you think about best practices and what makes an effective response, I think those are the things that come to top of mind.
• 25:14
  Brenda Sharton: Yeah, I would add to that.
• 25:16
  Brenda Sharton: One of the things that's going to be critical is you're going to have a good incident response plan, and that is going to help avoid the disorganization that John mentioned.
• 25:25
  Brenda Sharton: You're going to get counsel involved from the get-go because you need to clamp down that attorney-client privilege.
• 25:33
  Brenda Sharton: John mentioned jumping onto a moving train.
• 25:35
  Brenda Sharton: I always say the attorney-client privilege is like trying to keep a beach ball under water in the beginning.
• 25:41
  Brenda Sharton: There's been some communications, but it will protect the company exponentially to have it done under privilege.
• 25:49
  Brenda Sharton: You do not know what's going to come of that event.
• 25:52
  Brenda Sharton: You don't know what regulatory enforcement actions will come your way, litigation will come your way.
• 25:58
  Brenda Sharton: Never had a company regret having it done under attorney-client privilege, And that the lawyers should engage with the forensic firm so that it is subject to an attorney-client privilege.
• 26:09
  Brenda Sharton: So that's a couple of the things you don't want those early emails among the IT team saying,"I told them that this was going to be a big problem." You know, you don't want those unprivileged and having to be handed over to regulators or plaintiff's lawyers.
• 26:23
  Brenda Sharton: UYou're going to want to make sure that your PR firm is under privilege and engaged.
• 26:29
  Brenda Sharton: The communications with boards, with audit committees are under privilege.
• 26:33
  Brenda Sharton: And so those are all great points, John, and I couldn't agree with you more on sort of the blame and other things.
• 26:41
  Brenda Sharton: We kind of find that companies fall into two categories.
• 26:44
  Brenda Sharton: Either they want to move too fast on the notification and getting go, you know, before you have all the facts or they're a little bit too lax and how long it goes.
• 26:54
  Brenda Sharton: They're just a couple of other points that I wanted to make in terms of liability and protecting the company.
• 27:03
  Brenda Sharton: And that is after the breach.
• 27:04
  Brenda Sharton: Obviously you've tried to do everything under attorney-client privilege, and now you're going to have to assess your notification obligations.
• 27:11
  Brenda Sharton: Those fall into three buckets.
• 27:13
  Brenda Sharton: One, under the data breach statutes and potentially GDPR.
• 27:18
  Brenda Sharton: Do you have notification obligations because there has been personally identifying information that's been exposed to reviewing your contracts.
• 27:27
  Brenda Sharton: Do you have an obligation to notify either customers or investors or others if there was a breach of your systems?
• 27:34
  Brenda Sharton: And third, are there any securities disclosures that might be needed?
• 27:40
  Brenda Sharton: You have to start thinking, what did we want to tell a regulator or a government regulator that might surface in two months?
• 27:46
  Brenda Sharton: How do we want to describe what the company did to respond to this and start making that story now, doing all the right things now so that you can have a good, um, story to tell about the company's response.
• 28:00
  Brenda Sharton: If you should find yourself in front of a regulator, the FTC, state attorneys general, the SEC cybersecurity division, if there's health information offices, civil rights, HHS, any of those may come, the European regulators as well or data protection authorities.
• 28:22
  Brenda Sharton: So, Jessica, John, is there anything you wanted to add?
• 28:27
  Jessica Pizzo: Do you have any suggestions on who should manage external communications for a company if they're in the middle of a breach?
• 28:36
  Brenda Sharton: Yes.
• 28:36
  Brenda Sharton: Many times you'll have an internal communications team and depending on the size of the breach, if you expect a lot of publicity and it's a very, very big breach as counsel, we will engage a PR firm to work with the communications team and we'll do it all under privilege.
• 28:53
  Brenda Sharton: They will come up with and we will help them come up with external, you know, media holding statement so that if there is publicity, they will have something to go out with.
• 29:03
  Brenda Sharton: Frequently asked questions, we'll put together scripts so that if customers call in, notifications, that they may decide to put on the website to clarify if it gets publicized.
• 29:15
  Brenda Sharton: Most of the time, your companies are literally almost never going out with an affirmative press release about the data breach, but you want to be ready if you have a lot of publicity.
• 29:25
  Brenda Sharton: And, um, we've had many of those which we've helped clients with globally.
• 29:30
  Brenda Sharton: And so you're dealing with media throughout the world.
• 29:35
  Brenda Sharton: I want to thank John and Jessica for joining us today.
• 29:39
  Brenda Sharton: It was a great conversation.
• 29:41
  Brenda Sharton: For more information, or to listen to previous Committed Capital episodes, visit us on dechert.com.
• 29:48
  Brenda Sharton: And remember to subscribe on your favorite podcast platform so you can listen to our next episode covering restructuring involving alternative asset managers.
• 29:59
  Brenda Sharton: Jessica, John, thank you so much for being here today.
• 30:02
  Brenda Sharton: Thank you.
• 30:03
  Speaker 1: Thanks Brendan.
• 30:12
  Speaker 1: [inaudible].