In recent years, Congress has become increasingly focused on private sector cybersecurity practices as a matter of public concern and national security, particularly as the cybersecurity threat landscape continues to evolve rapidly. Lawmakers on both sides of the aisle have demonstrated sustained interest in whether companies appropriately collect, safeguard, and respond to compromises of sensitive data and protect critical systems, and cybersecurity is likely to remain a congressional priority regardless of which party controls Congress after the midterm elections.
This means that a cybersecurity incident may lead to scrutiny from Congress in addition to regulators, shareholders, and other stakeholders, such as consumers and customers. In this alert, we explain how cybersecurity incidents can attract congressional scrutiny, the distinct risks that arise when a cybersecurity incident draws congressional attention, and emerging areas of congressional focus that may increase scrutiny of corporate cybersecurity practices.