Salary · Cybersecurity
Cybersecurity attorney salary 2026: lockstep versus in-house
On 1 July 2026 the lockstep that privacy-and-cyber associates inherit moved to $235,000 at the first-year rung. The general counsel who must match it is still staffing a four-business-day SEC file. This page is one table, two readers.
Pick a seat. The clock is what priced it.
A general counsel matching cybersecurity attorney salary in 2026 is not buying a specialty premium. Sartori maps roughly 67,000 lawyers in New York. The dated cash move is the Milbank associate scale announced 2 June 2026 and effective 1 July 2026, which privacy-and-cyber lockstep seats inherit, set against Association of Corporate Counsel title medians that a company must actually write on an offer letter.
Am Law first-year base on the Milbank scale announced 2 June 2026, effective 1 July 2026. Privacy-and-cyber lockstep seats inherit this number. It is not a cybersecurity premium. Milbank memo ↗
Six published figures, two sides of one table, none of them a cybersecurity-only median. The comparison table is next.
- 4 days
- SEC Item 1.05 filing clock after a registrant determines a cybersecurity incident is material — still in force in 2026.
- SEC Release 33-11216, 26 July 2023
- $10.22M
- US average cost of a data breach in IBM's 2025 study — the capital around the seat, not a published legal-fee line.
- IBM Cost of a Data Breach Report 2025, 30 July 2025
- 32%
- Share of organizations with dedicated in-house cybersecurity counsel in ACC's 2025 global sample — up from 12% in 2018.
- ACC 2025 State of Cybersecurity Report
- $1,000+
- Average Am Law 100 lawyer standard rate in 2025, the outside-counsel alternative a general counsel prices against.
- Thomson Reuters 2026 State of the US Legal Market, January 2026
One law-firm versus in-house table. Do not average the rows.
The lawyer who earns the figure reads down the firm column. The general counsel who pays it reads across to the in-house title that actually sits on the incident-response team.
| Seat | Side | Cash | As of | What it measures |
|---|---|---|---|---|
| Am Law first-year base | Law firm | $235,000 | 1 July 2026 | Milbank lockstep; privacy-and-cyber seats inherit it |
| Am Law eighth-year base | Law firm | $455,000 | 1 July 2026 | Milbank lockstep, Class of 2018 |
| NY privacy-and-cyber entry | Law firm | $225,000 | 1 July 2026 | Hunton expected salary on a named Global Privacy and Cybersecurity seat |
| Attorney median base | In-house | $148,000 | 1 March 2025 | ACC US title table; not a cybersecurity-only median |
| Associate General Counsel median base | In-house | $245,000 | 1 March 2025 | ACC US title table; the band dedicated cyber counsel usually clears |
| General Counsel / Chief Legal Officer median base | In-house | $330,000 | 1 March 2025 | ACC US title table; the buyer of the seat |
| CISA Office of the Chief Counsel, Attorney Advisor | Federal | $78,592–$183,500 | December 2024 | GS-11/15; Secret / TS / TS-SCI; employer announcement |
Click a column header to re-rank. The Hunton row is an expected salary on a named privacy-and-cybersecurity associate seat, not a practice-wide median. The ACC rows are US title bands; the public 2025 executive summary ranks cybersecurity as a specialty and does not print a specialty dollar median. Figures: Milbank memo, Hunton careers, ACC 2025 survey, CISA OCC announcement.
ACC Attorney median base
US in-house title table, data effective 1 March 2025. Not a cybersecurity-only median.
ACC 2025 Law Department Compensation Survey ↗Read the axis the way a chief legal officer actually uses it. The candidate leaving a Class of 2021 Am Law seat is walking away from a $385,000 base on the Milbank memorandum of 2 June 2026. The Association of Corporate Counsel Associate General Counsel median, data effective 1 March 2025, is $245,000. That $140,000 gap is the 2026 conversation this page exists to name: not a mystery “cyber premium,” a title-versus-lockstep mismatch the company either closes or watches walk.
The lawyer who earns the figure reads the same axis from the other end. A first-year on the 1 July 2026 lockstep is looking at $235,000 before bonus. A named New York privacy-and-cybersecurity posting the same day listed $225,000. An in-house Attorney median of $148,000 is not a lateral for that person; it is a different job. The Associate General Counsel median is the first in-house title that even sits in the same conversation as mid-to-senior lockstep.
The Bureau of Labor Statistics Occupational Employment and Wage Statistics for May 2025 put the mean annual wage for all US lawyers at $185,840 and the median hourly wage at $76.76. That is a national all-lawyer floor, not a cybersecurity attorney figure, and it sits well below every lockstep rung and below the Associate General Counsel median. Use it as context after the table, never as the offer.
The four-business-day Item 1.05 file is still in force. It is what prices the seat.
Cybersecurity lawyer salary on the firm side is lockstep, not a practice card.
Privacy-and-cyber associates at scale-matching firms are paid by class year. The 2026 move was a market raise. It was not a cybersecurity increment.
A memorandum to associates dated 2 June 2026, signed by the firm’s then chair and posted as a PDF by Above the Law, set new US associate bases effective 1 July 2026: Class of 2026 and Class of 2025 at $235,000; Class of 2024 $245,000; Class of 2023 $270,000; Class of 2022 $320,000; Class of 2021 $385,000; Class of 2020 $410,000; Class of 2019 $440,000; Class of 2018 $455,000. Junior classes rose $10,000; fifth-year and above rose $20,000. That is one Am Law firm’s US associate scale. It is not a cybersecurity-practice premium, and no regulator, NALP table or firm announcement opened for this page published a 2025 or 2026 dollar increment that cybersecurity associates earn above the same firm’s corporate or litigation lockstep.
Hunton Andrews Kurth’s New York office posted a Class of 2027 entry-level Global Privacy and Cybersecurity associate seat on 1 July 2026 with “expected salary … $225,000.” The posting lists breach response, cybersecurity preparedness, US and international privacy frameworks, and regulatory investigations, and it requires New York bar admission within one year. It is the cleanest dated employer-own figure this page has for a named privacy-and-cyber associate seat. It landed the same calendar day the Milbank scale became effective, and it sat $10,000 below the new first-year floor. That is the opposite of a specialty premium.
NALP’s 2025 Associate Salary Survey, reported in the June 2025 Bulletin+, is the last large-firm first-year census before that raise. As of 1 January 2025 the overall median first-year associate base was $200,000; $150,000 in firms of 250 or fewer lawyers; $215,000 in firms of more than 700 lawyers. The $225,000 figure was the mode: 32.0% of all reporting offices and 44.7% of 701+ lawyer offices. Among 23 New York City offices reporting a first-year salary, 56.5% reported $225,000. About 87% of the 437 respondents were offices in firms of more than 250 lawyers. That is 2025, not 2026, and it is not a cybersecurity cut. It tells a general counsel why a New York lockstep candidate still hears $225,000 as last year’s number.
Biglaw Investor’s compiled table for search year 2026, accessed September 2026, lists first-year all-in cash of $256,000 ($235,000 base, $20,000 year-end, $6,000 special) and eighth-year all-in of $585,000 ($455,000 base, $115,000 year-end, $25,000 special). Those bonus rungs are a third-party compilation of announced lockstep and bonus ladders, not hours billed in a cyber practice. A 2026 year-end bonus scale from Cravath or Milbank had not been issued as of the research date for this page; treat the November 2025 bonus ladder as the last published one, not as a 2026 announcement.
Sartori’s quarterly survey since 2019 finds New York associate candidates leaving privacy-and-cyber lockstep seats still price the next role against the published class-year base, not against ACC title labels. A general counsel who opens with a title and a band the candidate cannot map to a class year is not negotiating. They are translating. The translation is where these searches stall.
Across the same New York interview cohort, 128 of the 214 respondents who sat in privacy, cybersecurity or incident-response seats over a 24-month window told Sartori the four-business-day Item 1.05 file — not a specialty premium over lockstep — is what moved the cash conversation with the general counsel.
A general counsel at a NYSE-listed software company, speaking over that same 24-month window, told Sartori they had budgeted the four-business-day file as a disclosure-counsel hour and then found the dedicated associate general counsel who would own Item 106 year-round had to clear Class of 2021 lockstep cash. That is the earner’s side of the table speaking through the buyer: the work is a clock, the cash is a class year.
Inside the company, cyber attorney salary is a title, and the title is usually executive.
The Association of Corporate Counsel publishes US in-house cash by title, not by cybersecurity. Dedicated cyber counsel, where it exists, sits high on that ladder.
ACC and Empsight’s 2025 Law Department Compensation Survey Executive Summary is a US self-reported survey (1,632 respondents in the PDF introduction; 1,637 in the 16 September 2025 newsroom release), with a data-effective date of 1 March 2025. Median base / median total cash from the published title table: Attorney $148,000 / $160,000; Senior Attorney $201,000 / $228,000; Expert Attorney $227,000 / $260,000; Managing Attorney $239,000 / $283,000; Associate General Counsel $245,000 / $294,000; Deputy General Counsel $280,000 / $368,000; General Counsel–Division/Subsidiary $279,000 / $341,000; General Counsel–Single Lawyer $234,000 / $255,000; General Counsel / Chief Legal Officer $330,000 / $410,000. Ninetieth-percentile GC/CLO base is $506,000; ninetieth-percentile total cash is $764,000. Short-term incentive eligibility runs from 83% (Attorney) to 96% (Deputy General Counsel and GC/CLO). Median merit increase for those not promoted: 3.0%.
The same executive summary ranks legal specialties by compensation. Securities, antitrust, and bankruptcy/creditor sit at the high end; information technology, corporate contracts, and entertainment at the low end. Cybersecurity appears in the middle of the published list, above privacy and information technology. The public PDF does not print a median base or total-cash figure for the cybersecurity specialty. A writer who turns that ranking into a dollar “cyber premium” is inventing. This page does not.
ACC’s 2025 State of Cybersecurity Report — 278 in-house legal professionals, 16 countries, 20 industries, so a global sample, not a US-only pay cut — is the prevalence companion to that title table. Where an organization already has dedicated in-house cybersecurity counsel, the most senior one is assistant general counsel, vice president, or other executive in 68% of cases (56% in 2022), senior counsel in 23%, and staff counsel in about 8%. Eighteen percent of respondents planned or were considering adding such a lawyer in the next two years. That is why a head of legal who grades the requisition as Attorney is usually buying a different seat from the one the CISO thinks they posted.
Reporting lines make the same point. In that 2025 ACC sample, 54% of organizations have a CISO or CSO (20% in 2015). Fifty-seven percent say the head of cybersecurity reports to the head of IT; 8% say the cyber lead reports to the Chief Legal Officer. Documented incident-response teams: 83%. On those teams, the Chief Legal Officer sits alone in 46% of cases (55% in 2022); the CLO plus another in-house lawyer devoted exclusively to cybersecurity in 27%; an in-house lawyer exclusively focused on cybersecurity in 20%. In single-lawyer departments, 98% of those counsel sit on the incident-response team, versus 12% of Chief Legal Officers in the largest departments. The cybersecurity attorney who earns the in-house figure typically sits in the law department, partners with the CISO, and is on the team. The general counsel still owns the file in smaller departments.
Credential gates are a preference, not a license. ACC asked organizations that have or intend to hire dedicated cyber counsel: 46% prefer an operational cybersecurity certification (examples given: Certified in Cybersecurity, CISSP, CISM); 9% require one; 45% do not seek those certifications. CIPP/US is the privacy-side counterpart. No opened official careers page required CISSP as a condition of a law-firm associate offer. The universal gate remains a US JD and an active bar — Hunton asked for New York admission within one year; CISA’s Office of the Chief Counsel asked for an active bar for GS-12 and above.
A head of talent at a DFS-licensed New York insurer told Sartori the 15 April 2026 Part 500 certification was the first time the board asked whether cybersecurity counsel sat inside the law department or on a panel. After a first letter that graded the seat as Attorney, they put it more bluntly: “We opened on Attorney cash and watched the shortlist go cold in eleven days.” That question is the company’s version of the table: a standing associate general counsel at ACC cash, or a panel hour every time the CISO’s incident hits materiality.
We opened on Attorney cash and watched the shortlist go cold in eleven days.
The 2026 cash moved because the clocks are running. One of them is not.
SEC Item 1.05, NYDFS Part 500, the FTC Safeguards notice and HIPAA are live. CIRCIA is a target. CMMC is a three-year phase-in. A general counsel who staffs against the wrong clock overpays or understaffs.
Live filingNot yet a filing
- Public-company disclosure Item 1.05 on Form 8-K after a materiality determination, plus annual Item 106 governance. The four-business-day file a chief legal officer already staffs.
- Sector clocks NYDFS 72-hour / 24-hour notice for licensed firms; FTC Safeguards 30-day notice; HIPAA 60-day breach notice. Same lawyer, different calendar, different buyer.
- Pending and phasing CIRCIA 72-hour / 24-hour CISA reports still waiting on a final rule. CMMC clauses available in DoD contracts, rolled in at discretion for three years. Playbooks now; headcount after the obligation lands.
The four-business-day Item 1.05 file is still in force. It is what prices the seat. SEC Release Nos. 33-11216 and 34-97989, adopted 26 July 2023, require a registrant that determines a cybersecurity incident is material to file a Form 8-K within four business days of that determination, not from discovery. Annual Regulation S-K Item 106 risk-management, strategy, and governance disclosure applies to annual reports for fiscal years ending on or after 15 December 2023. Item 1.05 compliance for most registrants ran from 18 December 2023; smaller reporting companies from 15 June 2024. A 21 May 2024 Division of Corporation Finance statement changed how the clock is used, not whether counsel is needed. Debevoise’s two-year tracker, updated 21 May 2026, counts, since that statement, 29 issuers with Item 1.05 filings and 50 issuers with Item 8.01 filings; only five issuers filed under both.
Wilson Sonsini’s first-year snapshot (18 December 2023 through 19 January 2025), published 6 February 2025, is a separate inclusion set and is not added to the Debevoise issuer counts. It records average days from detection to first filing at about 12, and only about 14% of filings stated the incident was material. The hiring consequence is the same seniority — disclosure counsel and incident-response partners on the firm side, associate general counsel or general counsel working with the CISO on the company side — with more work on documented materiality memos and item choice than on a high volume of mandatory 1.05 filings.
| Clock | Instrument | Who files | Status in 2026 |
|---|---|---|---|
| Four business days from materiality | SEC Form 8-K Item 1.05 | US registrants | In force (most filers from 18 December 2023) |
| 72-hour ransomware / 24-hour extortion notice | NYDFS 23 NYCRR Part 500 | DFS-licensed banks, insurers, other licensees | In force from 1 November 2023 |
| 30 days / 500 or more consumers | FTC Safeguards Rule notice | FTC GLBA financial institutions | In force from May 2024 |
| 60 days after discovery | HIPAA Breach Notification Rule | Covered entities and business associates | In force |
| 72-hour incident / 24-hour ransom payment | CIRCIA (CISA) | Covered critical-infrastructure entities | Not yet mandatory; Unified Agenda target September 2026 |
| CMMC status in the contract | DFARS 252.204-7021 / -7025 | DoD contractors processing FCI or CUI | Clauses available from 10 November 2025; three-year discretion |
HIPAA’s 60-day notice is a different calendar from Item 1.05’s four business days; the FTC Health Breach Notification Rule amendments of 26 April 2024 put a parallel 60-day dual notice on health apps not covered by HIPAA. NIST Cybersecurity Framework 2.0, released 26 February 2024, added a Govern function that shows up in board counseling. It is not a statutory clock.
CIRCIA, enacted March 2022, directs CISA to require covered entities to report covered cyber incidents within 72 hours of reasonable belief and ransom payments within 24 hours. CISA published the NPRM on 4 April 2024. CISA’s own page states reporting is not required until the final rule’s effective date. The OIRA Unified Agenda entry (RIN 1670-AA04) lists Final Rule date 09/00/2026; the statutory final-rule deadline of 4 October 2025 was missed. Hunton, on 17 July 2026, reported more than 1,200 stakeholders at CISA town halls held 15–18 June 2026. PwC’s CIRCIA page states the NPRM’s estimated covered population as 316,244 entities across 16 critical-infrastructure sectors. A Covington analysis dated 4 September 2026 notes OIRA review can take up to 90 days, so a September 2026 publication is a target, not a filing. Playbooks, vendor-notice clauses and coverage analyses are the 2026 work. Mandatory CISA reports are not.
NYDFS 23 NYCRR Part 500 is the live state clock that New York financial-services legal desks already pay for. The Second Amendment, effective 1 November 2023, requires 72-hour notice after determining a cybersecurity event that deploys ransomware in a material part of the information system, and 24-hour notice of an extortion payment. MFA for any individual accessing information systems and documented asset-inventory policies were the last two-year transitional items, due 1 November 2025; Greenberg Traurig, on 11 November 2025, stated covered entities first certify those provisions in annual certifications due 15 April 2026. A DFS industry letter of 21 October 2025 on third-party service providers sits on the same exam cycle. The in-house title that maps to this buyer is typically associate general counsel or vice president, cybersecurity and privacy, inside a broker-dealer, bank or insurer law department.
CMMC is the defense-industrial-base overlay. Crowell’s 10 September 2025 client alert on the CMMC Clause Rule records that from 10 November 2025 contracting officers may include DFARS 252.204-7021 (and solicitation notice -7025) in contracts that process FCI or CUI. For the first three years, CMMC is included at DoD’s discretion, not in every contract. “Current CMMC status” adds False Claims Act risk. DFARS 252.204-7012 incident reporting remains. The hiring label on the firm side is Government Contracts (cybersecurity), not “privacy.” DOJ Civil Cyber-Fraud Initiative settlements in 2025 show the desk is still paying: MORSECORP $4.6 million (26 March 2025), Raytheon/Nightwing $8.4 million (1 May 2025), Georgia Tech Research Corporation $875,000 (30 September 2025). Those are landscape facts, not case studies, and they are whistleblower False Claims Act matters, not entry-level incident-response seats.
Capital around the seat is breach cost and cyber premium, not a practice P&L. IBM’s 30 July 2025 newsroom release, fielded by Ponemon Institute across 600 organizations from March 2024 to February 2025, puts the US average breach cost at $10.22 million, up 9% from $9.36 million in 2024; the global average was $4.44 million. SecurityWeek, quoting IBM X-Force on the same day, attributed a 14% year-over-year jump in US detection-and-escalation costs in part to higher labor costs. IBM’s four cost buckets are detection/escalation, notification, post-breach response, and lost business; legal, accounting and consulting sit inside those buckets and are not published as a standalone legal-fee line. NAIC’s 2025 Report on the Cybersecurity Insurance Market records approximately $9.14 billion US direct written premium in 2024, down 7.11% from $9.84 billion in 2023, with claims up almost 40% to nearly 50,000. Cheaper premium, more claims: breach-counsel panels remain.
The company that opens on Attorney cash against a lockstep candidate is the one we still fail slowly.
Sartori has worked the New York associate market for more than 10 years. Over the trailing three years we closed 33 associate searches at a 93 percent completion rate, on a typical 6 to 12 week timeline. The cyber-adjacent cut of that book is where the table stops being a chart.
Of 33 closed New York associate searches over the trailing three years, 11 were privacy-and-cybersecurity or incident-response associate seats. Of those 11, 7 were bought by corporate legal departments hiring out of Am Law lockstep, and 4 were Am Law associate replacements. Among the 11 cyber-adjacent closed files, 4 drew a counter-offer from the incumbent employer against a city-wide associate-line counter-offer incidence of 37%. Median offer-to-acceptance on the associate line is 11 working days.
Three of those 11 cyber-adjacent files ran past 12 weeks because the company opened on an Attorney-title cash band against a lockstep candidate. Two of those three required a second offer after the first was declined. One of the 11 was withdrawn after the general counsel would not move off the Attorney median. That is the finding that does not flatter this desk: we can assemble the shortlist inside the ordinary 6 to 12 week window. We cannot close a lockstep earner on Attorney cash, and pretending the specialty label will do that work is how a search becomes the one that comes back.
That eleven-day stopwatch is not a market failure. It is the median offer-to-acceptance window on this line, used on an underpriced letter.
Panel hourNamed employee
- Buy the four-day file Incident-response and disclosure counsel on a panel, staffed when the CISO’s incident hits materiality. Right for episodic volume. Expensive as a standing governance desk.
- Hire the AGC A dedicated associate general counsel who owns Item 106, the playbook, the vendor clauses and the exam posture, and who still calls the panel when the four-day file is live.
- The general counsel owns it Single-lawyer departments put the chief legal officer on the incident-response team. The cash is GC cash. The clock does not get smaller.
If you are the cybersecurity attorney reading this as an offer, the number you can defend is a class year, not a specialty label.
- Map the letter to a class year. Scale-matching firms pay the same base across major US offices. The 2026 conversation is whether the in-house title clears the base you are leaving, not whether the posting says “cyber.”
- Treat bonus as last year’s ladder. The last published year-end scale in the compilation we opened is the November 2025 ladder. A 2026 year-end announcement had not issued as of this research date.
- Operational certificates are preferred, not a license. CIPP/US and CISSP help a general counsel say yes. They do not replace an active bar, and they did not appear as a condition on the Hunton associate posting.
If you are the general counsel writing the offer, you are matching a clock, not buying a practice-group brand.
- Price the standing desk against the panel hour. Thomson Reuters’ 2026 State of the US Legal Market, published January 2026 from a sample that includes 50 Am Law 100 firms, states that other segments averaged around $600 in 2025 and that average law-firm worked rates increased 7.3% that year. Standing Item 106 work is a poor use of an Am Law hour. The four-day file is not.
- Grade the requisition at Associate General Counsel when the CISO needs a named lawyer on the incident-response team. Attorney cash hires a different person than the one who will own the certification.
- Do not staff CIRCIA as if the reports were already due, and do not unstaff Item 1.05 because a comment letter asked to repeal it. The live clocks are the ones already in the table in the previous section.
Three anonymized composites from that 11-file cut, described by employer type only. No lawyer, firm or company names.
- A listed software general counsel needed an associate general counsel to own Item 106 and to sit on the incident-response team. The first letter landed near the ACC Senior Attorney median. The candidate was leaving a Class of 2021 lockstep seat. The revised letter cleared Associate General Counsel cash. Time-to-fill: nine weeks, inside the 6 to 12 week band, after the second offer.
- A DFS-licensed insurer needed vice-president-level cybersecurity counsel ahead of the 15 April 2026 Part 500 certification. The board had asked whether the work sat inside the law department. The search closed in eleven weeks on an AGC-altitude package. Outside counsel remained on exam defense. The employee owned the attestation.
- A Defense Industrial Base contractor needed a government-contracts associate who could read CMMC flowdowns and privileged readiness assessments, not a consumer-breach coach. Eight weeks. The hiring label was Government Contracts. The cash was lockstep, because that is what the candidate was leaving.
Practice labels that are actually hiring are compound: Global Privacy and Cybersecurity; Cyber/Data/Privacy; Digital Assets and Data Management; Cybersecurity and Data Privacy; Government Contracts cybersecurity / CMMC. Hunton, Cooley, Skadden and BakerHostetler all sell incident response to public-company general counsel; Crowell’s CMMC work is a second desk. Cooley’s practice page, accessed September 2026, states 400+ privacy and cybersecurity due-diligence reviews in the past year for M&A and investment — a self-reported marketing metric, useful only as evidence that sponsors buy this work at signing, not as a census. The privacy-and-cyber hiring market as a headcount story sits on a sibling page, Is privacy and data protection law hiring in 2026?; this page is the pay table that sibling does not own.
If you are the company that has to put this lawyer on the payroll, start with in-house counsel recruiting or, where the seat is still an Am Law associate replacement, associate recruiting. The methodology behind the New York figures is on how we map and measure.
The memorandum, the title survey, the docket, the clocks.
Lockstep bases come from a 2 June 2026 firm memorandum. In-house title medians come from ACC's 2025 US survey. The clocks come from the SEC, NYDFS, CISA, FTC, HHS and DoD instruments that still run in 2026.
The instruments behind the 2026 table
36 references- Sartori & Partners — New York Legal Talent Research Programme (1675 structured interviews; ~67,000 lawyers mapped; quarterly surveys since 2019; mandate telemetry) sartoriglobal.com ↗
- MEMORANDUM TO ASSOCIATES (Milbank, 2 June 2026) abovethelaw.com ↗
- ALERT: Milbank Does It Again — Associate Salaries Are Going Up!!! abovethelaw.com ↗
- New York – Entry-Level Global Privacy and Cybersecurity Associate hunton.com ↗
- $225,000 Entry-Level Salaries Not Yet the Standard at Large Firms nalp.org ↗
- Biglaw Salary Scale + Bonuses (1968 - 2026) biglawinvestor.com ↗
- Law Department Compensation Survey (2025 Executive Summary) acc.com ↗
- Association of Corporate Counsel and Empsight Release Industry-Leading, Comprehensive Data Report for In-house Professionals acc.com ↗
- CYBERSECURITY REPORT (ACC 2025 State of Cybersecurity) acc.com ↗
- Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure sec.gov ↗
- Cybersecurity Incident Disclosure: Form 8-K Tracker (Two-Year Update) debevoisedatablog.com ↗
- Snapshot: The First Year of Cybersecurity Incident Filings on Form 8-K Since Adoption of New Rules knowntrends.com ↗
- SEC Cybersecurity 8-K Filings Peaked in 2023 and Have Declined Since board-cybersecurity.com ↗
- Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) cisa.gov ↗
- View Rule: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements reginfo.gov ↗
- CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026 hunton.com ↗
- New proposed regulations for cyber incident reporting: PwC pwc.com ↗
- Cybersecurity Regulation 23 NYCRR Part 500 dfs.ny.gov ↗
- NYDFS Final Cybersecurity Rules – MFA, Asset Inventory, and Third-Party Risk gtlaw.com ↗
- Finally, the CMMC Final Rule… crowell.com ↗
- Defense Contractor MORSECORP Inc. Agrees to Pay $4.6 Million… justice.gov ↗
- Raytheon Companies and Nightwing Group to Pay $8.4M… justice.gov ↗
- Georgia Tech Research Corporation Agrees to Pay $875,000… justice.gov ↗
- FTC Finalizes Changes to the Health Breach Notification Rule ftc.gov ↗
- FTC Safeguards Rule: What Your Business Needs to Know ftc.gov ↗
- Breach Notification Rule | HHS.gov hhs.gov ↗
- CISA Office of the Chief Counsel Vacancy Announcement: Attorney Advisor cisa.gov ↗
- IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications… newsroom.ibm.com ↗
- Cost of Data Breach in US Rises to $10.22 Million, Says Latest IBM Report securityweek.com ↗
- 2026 Report on the State of the US Legal Market thomsonreuters.com ↗
- REPORT ON THE CYBERSECURITY INSURANCE MARKET content.naic.org ↗
- Table 1. National employment and wage data from the Occupational Employment and Wage Statistics survey by occupation, May 2025 bls.gov ↗
- SEC Dismisses Remainder of SolarWinds Case hunton.com ↗
- CISA Town Halls Signal Key Cyber Rule Changes Ahead cov.com ↗
- NIST Releases Version 2.0 of Landmark Cybersecurity Framework nist.gov ↗
- White House Unveils President Trump's Cyber Strategy for America whitehouse.gov ↗
Lockstep bases are one Am Law firm's US associate scale, inherited by privacy-and-cyber seats, not a practice premium. ACC figures are US title medians (compensation survey) or global prevalence (cybersecurity report) and are labeled as such; they are not a cybersecurity-only dollar median. 8-K trackers use different inclusion rules and are not added. CIRCIA reporting is not required until the final rule's effective date. IBM's US breach-cost figure is an organizational average; legal fees are not published as a standalone line. NAIC premium and claims are insurance-market facts, not attorney pay. BLS OEWS is all US lawyers, not a cyber cut.
Sartori’s New York associate-line numbers — the interview cohort, the 33 closed searches, the 11-file cyber-adjacent cut, counter-offer incidence, offer-to-acceptance and time-to-fill — come from the research program and mandate telemetry. Global coverage is framed as nearly 1.5 million lawyer profiles mapped, with quarterly market surveys running since 2019. Compensation figures on this page are information, not an offer to any candidate and not advice to any company.
The hiring page, the in-house bands, the desk that runs the search.
This page owns the 2026 cash table. Privacy-and-cyber hiring as a headcount story, broader in-house bands, and the search itself sit next door.
Is privacy and data protection law hiring in 2026?
The sibling that owns privacy-and-cyber hiring as demand and supply, not this pay table.
Read the hiring page SalaryIn-house counsel salary 2026
Title bands across the corporate legal department — the wider ladder this cybersecurity cut sits on.
Read in-house bands ServiceIn-house counsel recruiting
How we put a lawyer on a company payroll — including dedicated cybersecurity counsel a general counsel has to match.
Hire in-house counselCybersecurity attorney pay: the questions both readers ask
What is the cybersecurity attorney salary at a US law firm versus in-house in 2026?
On the 2026 Am Law lockstep, first-year base is $235,000 and eighth-year base is $455,000, effective 1 July 2026. In-house, the Association of Corporate Counsel’s 2025 US survey (data effective 1 March 2025) puts Attorney median base at $148,000 and Associate General Counsel at $245,000. Those are title bands, not a cybersecurity-only median. A named New York privacy-and-cybersecurity associate posting listed $225,000 on 1 July 2026 — not above the new lockstep floor. Do not average the firm scale with the in-house table.
Does a cybersecurity lawyer salary include a specialty premium over lockstep?
No public 2025 or 2026 dollar premium is published; a named New York posting listed $225,000 on 1 July 2026. Hunton’s Global Privacy and Cybersecurity associate seat carried that expected salary the day the Milbank scale became effective at $235,000 for first-years. ACC ranks cybersecurity among surveyed in-house specialties but does not print a specialty dollar median in the public 2025 executive summary.
What should a general counsel budget to hire dedicated cyber counsel?
Plan against the Associate General Counsel median of $245,000 base, not the Attorney median of $148,000. ACC’s 2025 cybersecurity report finds that where a dedicated cyber lawyer exists, the most senior one sits at assistant general counsel, vice president, or other executive level in 68% of those organizations. Opening on Attorney cash against a lockstep candidate is the miss we still see on this desk.
How fast must a public company file after a material cyber incident?
SEC Item 1.05 requires a Form 8-K within four business days of a materiality determination, not from discovery. The rule was adopted on 26 July 2023 and remains in force in 2026. After a 21 May 2024 Corp Fin statement, item choice shifted: Debevoise’s 21 May 2026 tracker counts 29 issuers on Item 1.05 and 50 on Item 8.01. The four-day file is still what a chief legal officer staffs.
Is CIRCIA already forcing new cybersecurity hires in 2026?
No. CISA reporting is not required until the final rule’s effective date, still a September 2026 target on the Unified Agenda (RIN 1670-AA04). The statute’s 72-hour / 24-hour clocks are real; the filing obligation is not yet live. Covered-entity general counsel are updating playbooks now. Do not unstaff the disclosure seat on a repeal rumor either: Item 1.05 has not been withdrawn.
How long does Sartori take to fill a New York cyber associate seat?
Typical New York associate searches close in 6 to 12 weeks, with a median of 11 working days from offer to signature. Of 33 closed New York associate searches over three years, 11 were privacy-and-cybersecurity or incident-response seats. The files that ran past twelve weeks were the ones where the company opened on Attorney-title cash against a lockstep candidate.
A quiet conversation
Match the clock, then write the number.
If you are the general counsel or head of legal who has to put a cybersecurity lawyer on the payroll, we will tell you whether the requisition is graded at the right title before anyone sees a name. Confidential, no obligation.