New Fed Cybersecurity Standards Could Be Used In Class Actions

The new cybersecurity standards for critical infrastructure from the National Institute for Standards and Technology’s (NIST), developed by executive order from President Obama, are voluntary and they do not constitute a checklist, write Mayer Brown attorneys Archis A. Parasharami, Stephen Lilley and Evan Wooten. Nonetheless, plaintiff lawyers following a breach may allege that a company’s failure to have met these standards is grounds for legal action, possibly targeting directors and officers, and companies need to be ready make the argument that what NIST has promulgated is not a liability standard.