The Israeli legal framework
The Privacy Protection (Data Security) Regulations, 2017 require every organization holding a database to implement security measures according to the database's security level. Among others: a database definition document, a security procedure, access management, access logging, vendor oversight and incident handling, including notifying the Privacy Protection Authority of a severe incident.
When an incident happens
In the first hours of a cyber incident, decisions with legal consequences are made: what to document, whom to inform, whether and when to notify the regulator, what to tell customers and vendors. Involving an attorney at this stage may allow parts of the investigation to be protected by privilege, subject to law and circumstances.
- Legal assessment of notification duties in Israel and other jurisdictions.
- Support in dealings with the Privacy Protection Authority.
- Drafting notices to customers and affected individuals.
- Working alongside the technical response team and the insurer.
Preparing before an incident
- An incident response procedure with clear roles.
- A joint tabletop exercise for management and the technical team.
- Reviewing the cyber insurance policy against realistic scenarios.
Vendors and the supply chain
- Security clauses in vendor and customer agreements.
- Answering customers' security questionnaires.
- Suppliers to European entities: the contractual implications of NIS2 and DORA, which push security requirements down the supply chain.
Reporting to management and the board
Cyber risk is business risk. The firm helps build a periodic reporting mechanism that allows management and the board to oversee the risk and document that oversight.
See also Regulation and Standards.