1E9Ct5D

2014, up from number 15 in 2013. 5 Even the best managed information technologyprograms remain vulnerable to cyber attack. The breadth and depth of the attack is allthat remains unknown.II.The Legal Obligations to Respond to Data LeaksForty-seven states currently have laws requiring notification of security informationinvolving personal information. 6The federal laws and regulations requiring notificationof information breaches are more patchwork and industry-specific. For instance theGramm-Leach-Bliley Act 7covers financial institutions, while the Health InsurancePortability and Accountability Act governs healthcare 8 . Despite repeated efforts andcountless pieces of proposed legislation, a federal standard remain elusive. TheFederal Trade Commission has publicly announced the need for legislation that wouldallow the FTC to mandate more uniform data security standards, while clarifying thetiming and content for notification of a security breach. 9The proposed federallegislation has run the gamut on whether state notification requirements should be preempted,and this remains an issue to watch. In the 2015 State of the Union address,President Obama reiterated the need for legislation that encourages businesses to5 Allianz Risk Barometer 2014, January 2014, http://www.agces.allianz.com/assets/PDFs/Reports/Allianz-Risk Barometer-2014_EN.pdf.6 For a summary of the various state laws, seehttps://www.beazley.com/PreBuilt/databreach/allstates.pdf.7 P.L. 106-102, 15 U.S.C. § 6801, et seq. (1992)8 P.L. No. 104-191, 110 Stat. 1938 (1996).9 Prepared Statement of the Federal Trade Commission, Data Breach on the Rise: Protecting PersonalInformation From Harm, Before the Committee on Homeland Security and Governmental Affairs, U.S.Senate (Apr. 2, 2014),