Patrick Norman

USX Cyber Chief Risk Officer

[Patrick Norman @SpitDice]

September recap: SEC disclosure rules, state privacy laws, AI governance. Regulatory convergence demands legal + technical expertise.
How is your organization preparing for continued evolution? 📅
#CybersecurityGovernance #RegulatoryCompliance #GeneralCounsel

[Patrick Norman @SpitDice]

New FTC cybersecurity guidance for financial institutions: Security programs must protect consumer interests, not just institutional assets.
How are you aligning security with consumer protection goals?
#FTCGuidance #FinancialServices #ConsumerProtection

[Patrick Norman @SpitDice]

Supply chain cyber incidents up 51% YoY (SecurityScorecard). Traditional indemnification clauses are inadequate for cascade incidents.
How have you updated vendor contracts for cyber coordination?
#SupplyChainRisk #VendorContracts #CyberLiability

[Patrick Norman @SpitDice]

New data: SOC 2 automation cuts audit prep by 70% (Statista, 2024). Companies see 55% fewer critical incidents with automated compliance (Forrester, 2023).
Multi-framework reality demands strategic decisions 📊
#ComplianceAutomation #CMMC #NIST #SOC2

[Patrick Norman @SpitDice]

AI governance is moving from voluntary guidelines to regulatory requirements. EU AI Act, NIST framework, and emerging U.S. rules demand systematic approaches.
How are you preparing legal frameworks for AI compliance?
#AIGovernance #ArtificialIntelligence #AIRegulation

[Patrick Norman @SpitDice]

Multi-state privacy laws creating compliance complexity: CCPA amendments, Virginia CDPA. Unlike GDPR, each state has unique requirements.
How are you managing the compliance patchwork?
#CCPAAmendments #StatePrivacyLaws #DataProtection

[Patrick Norman @SpitDice]

Clients love WhatsApp for speed, but lawyers see compliance risks. From privilege concerns to data retention and cross-border privacy, GCs must balance convenience with governance. Full article: https://t.co/iiAol9gJnG

[Patrick Norman @SpitDice]

ESG + cybersecurity convergence: Security maturity now viewed as an operational risk indicator. Incidents impact ESG scores.
How are you aligning security governance with ESG reporting? 📈
#ESGReporting #CybersecurityGovernance #SustainableFinance

[Patrick Norman @SpitDice]

77% of U.S. legal orgs increased AI spend last year; nearly half now call it essential. As AI moves from pilot to practice, GCs must ensure ethical use, data protection, and oversight frameworks that align innovation with integrity. #AIGovernance #LegalInnovation

[Patrick Norman @SpitDice]

Essential elements of modern board #CybersecurityReporting:
1. Risk appetite alignment & variance analysis
2. Regulatory compliance status & upcoming requirements
3. Vendor risk assessment results & mitigation strategies
4. Incident response effectiveness & lessons learned

[Patrick Norman @SpitDice]

CMMC 2.0 isn't just technical compliance, it's a contractual commitment with liability implications for defense contractors.
What approaches are you taking to CMMC legal risk? 🏛️
#CMMC #DefenseContracting #FederalCompliance

[Patrick Norman @SpitDice]

SMBs face 43% of cyberattacks, but only 14% have response plans (Verizon). Resource constraints demand managed security and compliance automation.
How are you addressing SMB compliance gaps? #SMBCybersecurity #MidMarketCompliance #ManagedSecurity

[Patrick Norman @SpitDice]

Remembering the 2,977 lives lost on 9/11 and honoring all who were affected. Their memory continues to inspire our commitment to protection and service.
#PatriotDay #NeverForget #911

[Patrick Norman @SpitDice]

New SEC rules: report material cyber incidents within 4 days. GCs need pre-established classification protocols and clear materiality frameworks.
What protocols are you establishing for rapid assessment?
#SECCompliance #CybersecurityDisclosure #GeneralCounsel

[Patrick Norman @SpitDice]

Manufacturing faces unique cyber challenges: OT systems, ERP integration, and supply chains. Traditional IT security often falls short.
How is your organization bridging OT/IT security gaps?
#ManufacturingSecurity #OTSecurity #ERPSecurity

[Patrick Norman @SpitDice]

Cyber insurance premiums up 74% YoY (Marsh). Coverage exclusions expanding. GCs are now central to translating security controls into policy language.
What changes are you making to the insurance evaluation?
#CyberInsurance #RiskManagement #GeneralCounsel

[Patrick Norman @SpitDice]

AI governance + data privacy = new compliance complexity for legal teams. Proactive policies beat reactive responses to enforcement.
How is your organization preparing for regulatory convergence? #AIGovernance #DataPrivacy #RegulatoryCompliance

[Patrick Norman @SpitDice]

Your security is only as strong as your weakest vendor. Third-party risk requires continuous oversight, not annual check-ins.
How is your organization modernizing vendor risk assessment? #ThirdPartyRisk #VendorManagement #SupplyChainSecurity

[Patrick Norman @SpitDice]

Workplace protections, like fair pay, safety, & hours, exist because workers fought for them. Laws followed their lead. Labor Day honors those who turned hardship into progress and built the legal frameworks we now uphold.
#LaborDay #EmploymentLaw #WorkplaceRights

[Patrick Norman @SpitDice]

Cyber insurance denials up 34% in 2024. 67% due to inadequate controls. Documented security frameworks reduce denials 45%. Average denial $2.3M. 58% result in litigation. Quarterly reviews cut disputes 41%. #CyberInsurance #InsuranceLaw