State of New York Office of General Services Cybersecurity Legal Services (Statewide) Contract - Award 23331
HSE is One of Five Approved Contractors for NYS Authorized Users for the Period January 6, 2025 to January 5, 2030
In an uncertain world of evolving data security threats and increased regulatory requirements, we provide our clients with peace of mind through crisis preparation, compliance oversight, risk mitigation, and incident response.
Harter Secrest & Emery provides the full slate of proactive and reactive data protection services, ranging from risk assessments, table-top exercises, and security assessments under the protection of the attorney-client privilege, to incident response and post-incident remediation advice. We have deep relationships to handle the most complicated incident scenarios, including close relationships with law enforcement, best in class data forensics and incident response (“DFIR”) providers, public relations firms, notification vendors, and ID theft protection and credit monitoring providers. We have successfully resolved incident-response engagements of all sizes in all 50 states, with notification obligations exceeding 3 million individuals, including one of the largest incidents reported in New York state. Our experience is truly unparalleled in our primary markets, and we balance that deep experience with an even deeper understanding of what it means to be a public institution in New York. With our over 125-year history, we understand community concerns, values, and needs, and bring that understanding to bear in all of our matters.
Scope of Services
As an awarded contractor for the New York State Office of General Services, the Harter Secrest & Emery Privacy and Data Security Team can advise New York State Authorized Users on the following:
Audit and reviews of:
- Cybersecurity incident response plans
- Cyber risk management and intellectual property
- Asset, privacy and data protection policies
- Preparedness activities (Incident Response Planning and Table-Top Drills) related to cybersecurity, cyber resiliency, cyber preparedness, and privacy
Incident response counseling including, but not limited to:
- Leading privileged incident response investigations
- Coordinating resources and efforts, including breach notification
- Communicating with government entities such as U.S. Department of Homeland Security, the FBI and other federal, state and local law enforcement
- Analyzing incident investigatory findings
- Providing advice on breach, notification, and privacy implications
- Advising on remedial actions following an incident
Advising on compliance measures related to:
- State, federal and international laws and regulations
- Policies and best practices related to cybersecurity, cyber resiliency, cyber preparedness, privacy, and related matters
Counseling on contract disputes with third-party vendors related to:
- Cybersecurity
- Cyber resiliency
- Cyber preparedness
- Privacy
- NetDiligence-authorized Breach Coach®. One of the few law firms in the world with this coveted designation. Learn more.
- Paul Greene, Partner and Chair of the HSE Privacy and Data Security team, is among the most credentialed privacy and data security attorneys in New York State. Learn more.
- A team boasting 9 individual privacy and data certifications, the most privacy professional credentials in the region. Learn more.
- Full-service privacy and data security services. The group creates strategies and protocols to help clients identify and mitigate risk, proactively protect their most sensitive information, prepare for a broad array of incidents, and respond effectively and efficiently to incidents when they do occur. NYS OGS Services.
- New York State-based law firm with offices throughout the State offering the sophistication and scope of a large firm practice, with the efficiency and accessibility of a small firm environment.
- HSE is the only law firm authorized under Award 23331 with offices solely in New York state, underscoring our commitment to the state and the local communities we serve.
Team and Individual Credentials




