processed and the nature of the business." The New York Privacy Act (NYPA) also proposed a 'duty of care' for risk assessments by controllers regarding personal data. The common theme in establishing duty of care is the assessment of risk, the likelihood of these risks occurring, and how they would impact all parties potentially affected by those risks. Companies must comply with these new requirements of their duty to for reasonable security as it applies to their working landscape - to manage risk appropriately or be liable for the harm they could cause. With compliance requirements of 'reasonable security' to protect data, there is also an increase in more data breach litigation examining if organizations practiced reasonable and appropriate security controls. Recent case settlements include Herff Jones and DNA Diagnostics in which these organizations must implement an information security program to manage risks based on documented frameworks such as Duty of Care Risk Analysis (DoCRA), CIS RAM, NIST, ISO 27005, or The Sedona Conference Commentary on a Reasonable Security Test. See also Due diligence Standard of care Reasonable person Duty of Care Risk Analysis (DoCRA) References Tort law Legal doctrines and principles