Technology Law and Digital Law

The Cybersecurity and Infrastructure Security Agency has moved its final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 to the Office of Management and Budget for review, marking the last major regulatory step before publication. With approximately 316,000 entities across 16 critical infrastructure sectors potentially subject to mandatory cyber incident reporting requirements, organizations need to understand the compliance obligations and prepare their incident respo

The New York State Department of Financial Services has issued new guidance identifying the most common deficiencies it encounters in cybersecurity risk assessments required under Part 500. Based on examinations and investigations, NYDFS outlines five recurring gaps and establishes clear expectations for how covered entities should design, conduct, and document risk assessments that inform their cybersecurity programs.

A Delaware Court of Chancery decision clarifies that public benefit corporation directors are not bound by traditional Revlon duties to maximize shareholder value in change-of-control transactions. This landmark ruling provides important guidance for founders, investors, and directors navigating the intersection of profit-driven objectives and mission-driven outcomes in the startup ecosystem.