Sarah Bartle

On Friday, the Department of Justice released an updated version of its Evaluation of Corporate Compliance Programs (“ECCP”) guidance—the latest in a series of updates to the administration’s approach to corporate criminal resolutions, and the first substantive update to the ECCP guidance since June 2020.

The January 2023 revisions to DOJ’s Corporate Enforcement Policy for the first time spelled out the factors that allow a company to qualify for a declination even in the presence of aggravating circumstances. This change has been touted alongside other significant revisions to the Policy—including increased penalty reductions in certain scenarios—as providing further encouragement for companies to self-disclose misconduct.

Institutions that work with the federal government are required to maintain certain security controls to protect covered information systems. Now, the DOJ is going after universities and research institutions. AdobeStock As has been widely reported, the Department of Justice (DOJ) launched its new Civil Cyber-Fraud Initiative on October 6, targeting entities that fail to follow cybersecurity-related contract requirements.