Photo of Matthew Harden

Matthew Harden

Matthew Harden is a cybersecurity and litigation associate in Covington’s New York office. He advises clients on cybersecurity and national security matters, including cybersecurity incident response, crisis management, enterprise risk management and governance, internal investigations, and regulatory compliance.

Matthew helps clients prepare for and respond to cybersecurity incidents and data security events. He advises on cybersecurity investigations, counsels on incident response strategy, and helps clients assess legal, regulatory, and litigation risks arising from data breaches, network intrusions, ransomware, insider threats, digital threats, and other cyber matters.

Matthew counsels clients on cybersecurity and information security governance. He assists with drafting, designing, and assessing enterprise cybersecurity policies, information security programs, incident response plans, and related procedures. His work includes advising on cybersecurity and privacy compliance obligations, emerging cybersecurity regulations, and legal risks associated with artificial intelligence (AI), Internet of Things (IoT) technologies, and connected products.

As part of his litigation and investigations practice, Matthew draws on his cybersecurity experience to advise clients in high-stakes disputes, internal investigations, and regulatory matters. He represents government contractors in False Claims Act matters involving cybersecurity and national security. He also maintains an active pro bono practice focused on veterans’ rights.

Matthew serves as a Judge Advocate in the U.S. Coast Guard Reserve.

Last week, the U.S. Cybersecurity and Infrastructure Security Agency released guidance on Security-by-Design and Security-by-Default principles for technology manufacturers that was jointly developed by the Federal Bureau of Investigation and the National Security Agency, as well as cybersecurity authorities in Australia, Canada, United Kingdom, Germany, Netherlands, and New Zealand.  The

Continue Reading CISA Publishes International Guidance on Implementing Security-by-Design and Security-by-Default Principles for Software Manufacturers and Customers

This is the twenty-second in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the subsequent blogs described the actions taken by various government agencies to implement the Cyber EO from June 2021 through January 2023.  This blog describes key actions taken to implement the Cyber EO during February 2023.

Continue Reading February 2023 Developments Under President Biden’s Cybersecurity Executive Order

The United States National Cybersecurity Strategy, released on March 2, 2023, is poised to place significant responsibility for cybersecurity on federal contractors, technology companies, and critical infrastructure owners and operators.  The Strategy articulates a series of objectives and recommended executive and legislative actions that, if implemented, would increase the

Continue Reading White House Releases National Cybersecurity Strategy

On January 19, 2023, the National Institute of Standards and Technology (“NIST”) published a Concept Paper setting out “Potential Significant Updates to the Cybersecurity Framework” and requesting public feedback and comments on the proposed revisions by March 3, 2023.  Originally released in 2014 and previously updated in 2018, the

Continue Reading NIST Requests Comments on Potential Significant Updates to the Cybersecurity Framework

On September 12, 2022, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) published a Request for Information, seeking public comment on how to structure implementing regulations for reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”).  Written comments are requested on or before November 14, 2022 and may be submitted through the Federal eRulemaking Portal: http://www.regulations.gov.

Continue Reading CISA Requests Public Comment on Implementing Regulations for the Cyber Incident Reporting for Critical Infrastructure Act