The US Cybersecurity and Infrastructure Security Agency (CISA) has recently released draft rules that are set to reshape how critical infrastructure companies report cyberattacks to the US government. The rules are designed to improve the country's cybersecurity by making sure cyber incidents are reported quickly and thoroughly. This could help create a clearer understanding of cyber threats and may mitigate against future cyberattacks.
Tech & Sourcing @ Morgan Lewis
TECHNOLOGY TRANSACTIONS, OUTSOURCING, AND COMMERCIAL CONTRACTS NEWS FOR LAWYERS AND SOURCING PROFESSIONALS
New ICT incident reporting requirements under Circular 24/847 (Circular) of the Commission de Surveillance du Secteur Financier (CSSF), Luxembourg’s financial regulator, will come into effect on April 1. This introduces a new ICT-related incident reporting framework and underscores the critical importance of proactive measures in safeguarding financial institutions against ICT and cyber threats.
The European Central Bank (ECB) has published data showing that banks are increasingly using third-party providers to support their critical functions. However, more than 10% of outsourcing contracts covering critical functions are not compliant with the relevant regulations. During a key year for EU financial institutions and their critical service providers—with implementation projects for the Digital Operational Resilience Act (DORA) well underway—the ECB signals that outsourcing and resiliency, particularly risks associated with cloud outsourcing and concentration risks, will be a top priority on its supervisory agenda.
Join Pittsburgh partner Peter Watt-Morse and Philadelphia partner Barbara Melby and associate Katherine O’Keefe at 12:00 pm ET on Wednesday, January 24, 2024 as they highlight considerations for companies in the financial services and insurance industries that contract for technology and outsourcing services.
The UK government introduced its Digital Markets, Competition and Consumers Bill to Parliament for approval on April 25, 2023. The bill establishes a “pro-competition framework” for digital markets, specifically targeting a small number of tech firms with significant market power that will receive a “Strategic Market Status” (SMS) designation.
The UK government published a white paper on March 29 setting out a “pro-innovation” UK regulatory framework for artificial intelligence (AI). The framework centers upon five cross-sectoral principles, of which implementation will be context-specific to the use of AI, rather than the technology itself. The government does not propose introducing a new regulator or any new legal requirements on businesses, instead leveraging existing powers of UK regulators and their domain-specific expertise.
The UK Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) on December 20, 2022, announced fines totaling £48.65 million ($59 million) on TSB Bank plc (TSB) for operational resiliency failures, after an IT upgrade led to customers being unable to access core banking services.
On October 11, the Bank of England (BoE), the Prudential Regulation Authority (PRA), and the UK Financial Conduct Authority (FCA) (together, the Supervisory Authorities) published a discussion paper (DP5/22) on the safe and responsible adoption of artificial intelligence (AI) in financial services (Discussion Paper). The Discussion Paper forms part of the Supervisory Authorities’ AI-related program of works, including the AI Public Private Forum and is being considered in light of the UK government’s efforts towards regulating AI.
The UK’s Law Commission (the Commission) published a consultation paper on July 28, 2022, proposing certain reforms to private property law in relation to digital assets, which was in response to the UK government requesting the Commission to ensure that the law can accommodate digital assets as they continue to evolve and expand. The Commission acknowledged the increasingly important role digital assets play and that property rights are key for the proper characterization of novel and complex legal relationships involving digital assets.
The financial services regulations relating to outsourcing by Luxembourg-headquartered financial institutions have been significantly simplified by the introduction of the Commission de Surveillance du Secteur Financier (CSSF) outsourcing circular CSSF 22/806 (Outsourcing Circular).