Regulatory Advisory

Helping clients achieve regulatory compliance using their
definition of “reasonable” and “appropriate.”

Example Engagement
Engaging Outside Counsel for a Regulatory Matter

An application service provider engaged HALOCK to help them establish a risk-based approach to address multiple security and privacy regulations.

HALOCK’s Duty of Care Risk Analysis (“DoCRA”) method defines each client’s reasonable and appropriate level of risk in a way that aligns with due care. This helps evaluate security in terms that are friendly to business and compliance, but it should involve specialized counsel.

HALOCK convinced the client to further engage outside counsel to help define risk assessment and risk acceptance criteria, to participate in risk reduction planning, and to review draft materials. The client’s executive officers and Board of Directors gained confidence that the resulting risk analysis and risk reduction plan were openly and frankly evaluated, and that resulting analysis and plans were defensible to regulators and, if necessary, litigators.

Frequently Asked Questions (FAQ) on Reasonable Security

Why is “Reasonable” Security Important?

“Reasonable security” language is found in most state and federal privacy laws, and regulators have ruled that you must show you took “reasonable” steps to protect sensitive information.

Reasonable security does not mean perfect security, but rather security that makes sense based on your risks and resources.

Organizations with reasonable security:

Have a better chance of avoiding regulatory action after a breach
Are better positioned during litigation and investigations
Have more support from cyber insurance carriers and adjusters
Instill more confidence with clients, partners, and stakeholders

What Laws and Regulations Reference “Reasonable Security”?

In the United States, a variety of state and federal laws and regulations require organizations to have “reasonable security practices and procedures.” These include, but are not limited to:

California Consumer Privacy Act (CCPA / CPRA)

“(3) Grants the business rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the business’ obligations under this title.”
“(5) Grants the business the right, upon notice, including under paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.”
“(e) A business that collects a consumer’s personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.”

CA Civ Code § 1798.81.5

“(b) A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
(c) A business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party that is not subject to subdivision (b) shall require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”

New York SHIELD Act

“requiring that companies develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of the private information”

Illinois Personal Information Protection Act (PIPA)

(a) A data collector that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
(b) A contract for the disclosure of personal information concerning an Illinois resident that is maintained by a data collector must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

Massachusetts 201 CMR 17.00

“(4) Reasonable monitoring of systems, for unauthorized use of or access to personal information;”

Connecticut Data Privacy Act

Controllers must “Use reasonable safeguards to secure personal data.”

Gramm-Leach-Bliley Act (GLBA)

“the Gramm-Leach-Bliley Act, sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.”

Federal Trade Commission (FTC) Safeguards Rule

“What does a reasonable information security program look like?”

General Data Protection Regulation (GDPR)

“every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);”

How Do You Demonstrate Reasonable Security?

The most effective way is through a documented, risk-based assessment process that allows you to show how your organization identifies, prioritizes, and mitigates risks.

A legally defensible risk assessment provides a fact-based argument that your actions were prudent, informed, and proportionate.

Key elements include:

Risk identification: What data, systems, and processes are impacted?
Threat and vulnerability analysis: What risks are credible and foreseeable?
Impact assessment: What could cause harm to customers, partners, or operations?
Control evaluation: What safeguards are reasonable under current conditions?
Documentation: Written records of your findings, decisions, and mitigations.

Security and legal frameworks such as NIST SP 800-30, ISO 27005, CIS Controls, and DoCRA (Duty of Care Risk Analysis) can help define and prove what “reasonable” looks like in practice.

Is Reasonable Security the Same as Compliance?

No. Compliance meets minimum standards, but reasonable security shows you went above and beyond with due care.

What Is the Duty of Care Risk Analysis (DoCRA)?

The Duty of Care Risk Analysis (DoCRA) standard is an approach to establish and document reasonable security for an organization. It states that reasonable security is:

“Security that balances the interests of the organization with the interests of others who may be harmed if security fails.”

DoCRA helps organizations to review and justify risk decisions, not only from a compliance point of view but also with respect to fairness, proportionality, and legal defensibility. In essence, it considers an organization’s mission, objectives, and obligations. It effectively bridges security, business, and legal aspects in one defensible framework.