Publications

• NYU Compliance & Enforcement: NIST Releases Most Significant Update to Cybersecurity Framework Since 2014
  25 March 2024
  Compliance & Enforcement
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Michael R. Roberts
  ,
  H Jacqueline Brehmer
  ,
  Annabella M. Waszkiewicz
• SEC Cybersecurity Rules: FBI, DOJ and SEC Publish Guidance on Disclosure Delays
  18 December 2023
  Charu A. Chandrasekhar
  ,
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Benjamin R. Pedersen
  ,
  Paul M. Rodel
  ,
  Matt Kelly
  ,
  Alice Gu
  ,
  Paul D. Lowry
  ,
  Michael R. Roberts
• A Summary of the Final Amendments to the NYDFS Cyber Rules
  15 November 2023
  Charu A. Chandrasekhar
  ,
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Caroline N. Swett
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Stephanie D. Thomas
  ,
  Joshua A. Goland
• California Attorney General’s CCPA Sweep Indicates Focus on HR Data
  21 July 2023
  Avi Gesser
  ,
  Tricia Bozyk Sherno
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
• Harvard Forum on Corporate Governance: Takeaways from Proposed Changes to the NIST Cybersecurity Framework
  1 April 2023
  Harvard Forum on Corporate Governance
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Corey Jeremy Goldstein
  ,
  H Jacqueline Brehmer
  ,
  Michael R. Roberts
  ,
  Stephanie D. Thomas
• CLS Blue Sky Blog: Debevoise Discusses White House’s National Cybersecurity Strategy
  30 March 2023
  CLS Blue Sky Blog
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Jim Pastore
  ,
  Michael R. Roberts
• NYU Compliance & Enforcement: A Late Winter Blizzard of SEC Cybersecurity Rulemaking: the Proposed BD Cybersecurity Rules and Expanded Reg S-P and Reg SCI Obligations
  30 March 2023
  NYU Compliance & Enforcement
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Marc Ponchione
  ,
  Julie M. Riewe
  ,
  Jeff Robins
  ,
  Kristin A. Snyder
  ,
  Charu A. Chandrasekhar
  ,
  Sheena Paul
  ,
  Suchita Mandavilli Brundage
  ,
  Michael R. Roberts
  ,
  Mengyi Xu
  ,
  Ned Terrace
• NYU Compliance & Enforcement: Does Your Company Need a ChatGPT Pilot Program? Probably
  24 March 2023
  NYU Compliance & Enforcement
  Megan K. Bannigan
  ,
  Avi Gesser
  ,
  Henry Lebowitz
  ,
  Benjamin Leb
  ,
  Jarrett Lewis
  ,
  Melissa Muse
  ,
  Michael R. Roberts
• Does Your Company Need a ChatGPT Pilot Program? Probably.
  21 March 2023
  Megan K. Bannigan
  ,
  Avi Gesser
  ,
  Henry Lebowitz
  ,
  Benjamin Leb
  ,
  Jarrett Lewis
  ,
  Melissa Muse
  ,
  Michael R. Roberts
• A Late Winter Blizzard of SEC Cybersecurity Rulemaking: the Proposed BD Cybersecurity Rules and Expanded Reg S-P and Reg SCI Obligations
  20 March 2023
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Marc Ponchione
  ,
  Julie M. Riewe
  ,
  Jeff Robins
  ,
  Kristin A. Snyder
  ,
  Charu A. Chandrasekhar
  ,
  Sheena Paul
  ,
  Suchita Mandavilli Brundage
  ,
  Michael R. Roberts
  ,
  Mengyi Xu
  ,
  Ned Terrace
• NYU Compliance & Enforcement: Does Your Company Need a ChatGPT Policy? Probably
  10 February 2023
  NYU Compliance & Enforcement
  Megan K. Bannigan
  ,
  Avi Gesser
  ,
  Henry Lebowitz
  ,
  Michael R. Roberts
  ,
  Melissa Muse
  ,
  Benjamin Leb
  ,
  Jarrett Lewis
• Does Your Company Need a ChatGPT Policy? Probably.
  8 February 2023
  Megan K. Bannigan
  ,
  Avi Gesser
  ,
  Henry Lebowitz
  ,
  Erez Liebermann
  ,
  Benjamin Leb
  ,
  Jarrett Lewis
  ,
  Melissa Muse
  ,
  Michael R. Roberts
• Practising Law Institute: Privacy Law Answer Book
  23 January 2023
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Jyotin Hamid
  ,
  Satish M. Kini
  ,
  Henry Lebowitz
  ,
  Erez Liebermann
  ,
  Maura Kathleen Monaghan
  ,
  David A. O'Neil
  ,
  Jim Pastore
  ,
  David Sarratt
  ,
  Jeffrey P. Cunard
  ,
  Kim T. Le
  ,
  Tricia Bozyk Sherno
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Michael Bloom
  ,
  Fanny Gauthier
  ,
  Corey Jeremy Goldstein
  ,
  Hannah R. Levine
  ,
  Linda Lin
  ,
  Melissa Muse
  ,
  Kate Saba
  ,
  Noah L. Schwartz
  ,
  Mengyi Xu
• Report Underscores FINRA’s Focus on Cybersecurity
  18 January 2023
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Kristin A. Snyder
  ,
  Charu A. Chandrasekhar
  ,
  Michael R. Roberts
• Recent SEC EXAMS Risk Alert Highlights Key Considerations for Reg S-ID Compliance
  15 December 2022
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Kristin A. Snyder
  ,
  Charu A. Chandrasekhar
  ,
  Michael R. Roberts
  ,
  Noah L. Schwartz
• CLS Blue Sky Blog: Debevoise & Plimpton Discusses “Dark Patterns” and Regulatory Scrutiny
  20 October 2022
  CLS Blue Sky Blog
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Melissa Muse
• NYU Compliance & Enforcement: California’s Age-Appropriate Design Code Act Expands Businesses’ Privacy Obligations Regarding Minors
  27 September 2022
  NYU Compliance & Enforcement
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Michael Bloom
  ,
  Martha Hirst
  ,
  Alessandra G. Masciandaro
• Recent SEC Enforcement Actions Signal Key Lessons for Reg S-ID Compliance
  3 August 2022
  Avi Gesser
  ,
  Erez Liebermann
  ,
  Kristin A. Snyder
  ,
  Charu A. Chandrasekhar
  ,
  Noah L. Schwartz
  ,
  Michael R. Roberts
• CPRA Rulemaking Is Underway - Getting Ahead of Enforcement Risks
  2 August 2022
  Avi Gesser
  ,
  David Sarratt
  ,
  Christopher S. Ford
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  H Jacqueline Brehmer
• Columbia Blue Sky Blog: Debevoise Discusses What the ADPPA Means for U.S. Data Regulation
  15 July 2022
  Columbia Blue Sky Blog
  Paul D. Rubin
  ,
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Alessandra G. Masciandaro
• 36-Hour Breach Notification for Banks is Here
  31 May 2022
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
• NYU Compliance & Enforcement: Data Minimization – Recent Enforcement Actions Show Why Some Companies Need to Get Rid of Old Electronic Records
  26 May 2022
  NYU Compliance & Enforcement
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
• How Private Equity Firms Can Prepare for the SEC’s Proposed Cybersecurity Rules
  May 2022
  Avi Gesser
  ,
  Julie M. Riewe
  ,
  Kristin A. Snyder
  ,
  Charu A. Chandrasekhar
  ,
  Michael R. Roberts
• Private Equity Report Spring 2022, Vol 22, No 1
  May 2022
  Catherine Amirfar
  ,
  Andrew L. Bab
  ,
  Megan K. Bannigan
  ,
  David H. Bernstein
  ,
  Alexander R. Cochran
  ,
  Avi Gesser
  ,
  Ted Hassi
  ,
  Eric T. Juergens
  ,
  Matthew E. Kaplan
  ,
  M. Natasha Labovitz
  ,
  Sidney P. Levinson
  ,
  Pierre Maugüé
  ,
  Marc Ponchione
  ,
  Ina C. Popova
  ,
  Natalie L. Reid
  ,
  Julie M. Riewe
  ,
  Scott B. Selinger
  ,
  Kristin A. Snyder
  ,
  Ramya S. Tiller
  ,
  Richard Ward
  ,
  Erica S. Weisgerber
  ,
  Charu A. Chandrasekhar
  ,
  Nick S. Kaluk III
  ,
  Sheena Paul
  ,
  Christopher Rosekrans
  ,
  Jennifer Wheater
  ,
  Paul Eastham
  ,
  Christopher S. Ford
  ,
  Christine Shu Gilleland
  ,
  Michael C. Godbe
  ,
  Jessica Polebaum
  ,
  Michael R. Roberts
  ,
  Kate Saba
• NYU Compliance & Enforcement: Utah Joins the Comprehensive State Privacy Law Club
  3 May 2022
  NYU Compliance & Enforcement
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Alessandra G. Masciandaro
• NYU Compliance & Enforcement: The Value of AI Incident Response Plans and Tabletop Exercises
  27 April 2022
  NYU Compliance & Enforcement
  Avi Gesser
  ,
  Michael R. Roberts
  ,
  Corey Jeremy Goldstein
• The Value of AI Incident Response Plans and Tabletop Exercises
  27 April 2022
  Avi Gesser
  ,
  Corey Jeremy Goldstein
  ,
  Michael R. Roberts
• Six Key Takeaways from the SEC’s Most Recent Proposed Cybersecurity Rules for Registrants
  14 March 2022
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Matthew E. Kaplan
  ,
  Charu A. Chandrasekhar
  ,
  H Jacqueline Brehmer
  ,
  Michael R. Roberts
  ,
  Rebecca Zipursky
• NYU Compliance & Enforcement: Data Minimization – Recent Enforcement Actions Show Why Some Companies Need to Get Rid of Old Electronic Records
  9 March 2022
  NYU Compliance & Enforcement
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
• NYU Compliance & Enforcement: Time to Update Cyber Incident Response Plans, Especially for Banks Subject to the New 36-Hour Breach Notification Rule
  31 January 2022
  NYU Compliance & Enforcement
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael R. Roberts
  ,
  Michelle Huang
• 2021/2022 Private Equity Year-End Review and Outlook
  January 2022
  Jonathan Adler
  ,
  Catherine Amirfar
  ,
  Christopher Anthony
  ,
  Katherine Ashton
  ,
  Andrew L. Bab
  ,
  Geoffrey P. Burgess
  ,
  Ezra Borut
  ,
  Andrew J. Ceresney
  ,
  Jennifer L. Chu
  ,
  Jeffrey P. Cunard
  ,
  Alexander R. Cochran
  ,
  E. Drew Dutton
  ,
  Jane Engelhardt
  ,
  Morgan J. Hayes
  ,
  Eric T. Juergens
  ,
  Maurizio Levi-Minzi
  ,
  Nicholas P. Pellicani
  ,
  Ryan T. Rafferty
  ,
  Julie M. Riewe
  ,
  Scott B. Selinger
  ,
  Marc Ponchione
  ,
  Thomas Smith
  ,
  Ramya S. Tiller
  ,
  Patricia Volhard
  ,
  Richard Ward
  ,
  Alisa A. Waxman
  ,
  Marshal L. Bozzo
  ,
  Christopher Dortschy
  ,
  Andrew J. Gershon
  ,
  Emily F. Huang
  ,
  Jennifer Wheater
  ,
  Dominic Blaxill
  ,
  Charles Cartiglia
  ,
  Robert T. Dura
  ,
  Matthew J. Sacco
  ,
  Sheng Shao
  ,
  Sergio Torres
  ,
  Charlotte A. Walkovik
  ,
  Paul Eastham
  ,
  Christopher Gossage
  ,
  Robert B. Kaplan
  ,
  Sheena Paul
  ,
  John Young
  ,
  Jin-Hyuk Jang
  ,
  Lukas Ott
  ,
  Andrew M. Levine
  ,
  Stuart Hammer
  ,
  Ulysses Smith
  ,
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Michael R. Roberts
  ,
  Peter J. Irwin
  ,
  Ina C. Popova
  ,
  Samantha J. Rowe
  ,
  M. Natasha Labovitz
  ,
  Sidney P. Levinson
  ,
  Paul D. Rubin
  ,
  Eric Dinallo
  ,
  Marilyn A. Lion
  ,
  Jacob W. Stahl
  ,
  Nicholas F. Potter
  ,
  Kim T. Le
  ,
  Adam Aukland-Peck
  ,
  Melissa Runsten
  ,
  Matthew Mrozek
  ,
  Michael C. Godbe
  ,
  Christel Y. Tham
  ,
  Lisa Wang Lachowicz
  ,
  Yiran Ji
• Time to Update Cyber Incident Response Plans, Especially for Banks Subject to the New 36-Hour Breach Notification Rule
  19 January 2022
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michelle Huang
  ,
  Michael R. Roberts
• NYU Compliance & Enforcement Blog: Regulatory Risks of the Log4j Vulnerability: FTC Warns Companies to Take Reasonable Steps to Protect Consumer Data
  10 January 2022
  NYU Compliance & Enforcement Blog
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Michael R. Roberts
  ,
  Kathryn T. Mueller
• Regulatory Risks of the Log4j Vulnerability: FTC Warns Companies to Take Reasonable Steps to Protect Consumer Data
  10 January 2022
  Luke Dembosky
  ,
  Avi Gesser
  ,
  Michael R. Roberts
• NYU Compliance & Enforcement Blog: Getting Ready for 2023: What Companies Can Do Now to Prepare for New Privacy Laws
  20 December 2021
  NYU Compliance & Enforcement Blog
  Avi Gesser
  ,
  Johanna N. Skrzypczyk
  ,
  Michael Bloom
  ,
  Michael R. Roberts
  ,
  Tricia Reville
  ,
  Kate Saba