Insights

London – June 11, 2026: Crowell & Moring Partner Emma Wright has been appointed to the UK Government's newly formed Digital ID Advisory Group, an independent body of experts convened by Right Honorable Darren Jones MP, to support the delivery of a national digital ID system that is inclusive, useful, and trusted. 

Washington – June 4, 2026: Crowell & Moring earned 92 individual rankings for 81 attorneys, as well as 48 national and statewide practice area rankings, in the Chambers USA 2026 guide. The Chambers guide ranks the country’s top law firms and lawyers through in-depth research, client interviews, and feedback from attorneys at peer firms. 

Washington – November 5, 2025: Crowell & Moring ranked nationally in 20 practice areas in the 2026 edition of Best Lawyers "Best Law Firms." In addition, the firm was ranked in 38 metropolitan categories. 

The EU Cyber Resilience Act (CRA) is an EU product cybersecurity law for connected products (formally, “products with digital elements” under the CRA) commercialized in the EU; it entered into force on 10 December 2024, with direct application across the EU. Full application begins 11 December 2027, but one of its most operationally demanding provisions takes effect in just under 100 days, on 11 September 2026: the mandatory vulnerability and incident reporting under Article 14 CRA.

On March 2, 2023, the Biden Administration released the 35-page National Cybersecurity Strategy (the “Strategy”) with a goal “to secure the full benefits of a safe and secure digital ecosystem for all Americans.”

Senator Maggie Hassan (N.H.-D): “My question is, in your planning, did you have a plan for cybersecurity response that included guidance about ransomware?”

Every day, organizations face a barrage of attacks from cybercriminals looking to do harm by gaining access to IT systems and sensitive data. Repercussions from these attacks can be significant—lost business data, legal liability, regulatory scrutiny, and a damaged reputation. To prepare for potential attacks, companies need a robust incident response plan that can be quickly and effectively deployed against cyber threats as they arise.

In this episode, host Kate Growley and Caroline Brown talk about the regulatory risks of violating sanctions and anti-money laundering laws when considering whether to make a payment to ransomware attackers. Those risks extend beyond the victims of the ransomware attack themselves to include ransomware insurance businesses, payment processors, and companies involved in digital forensics and incident response. Crowell & Moring’s “Byte-Sized Q&A” podcast takes the complex world of government contracts cybersecurity and breaks it down into byte-sized pieces.