Gartner identifies three mandates for legal and compliance leaders in response to Ukraine invasion

• Advise on how to implement sanctions requirements and best protect employees on the ground who are at risk of being held criminally liable for the organization’s response to sanctions, given the aggressive blocking legislation passed in Russia.
• Assess sales and supplier contracts to identify those impacted by sanctions and sort those into two groups: those that can be terminated immediately and those with a wind down period. Then provide sales, service, and sourcing colleagues with appropriate scripting and procedures for informing sanctions parties that contracts will be terminated. Create real-time communications channel for sharing information among impacted partners as new sanctions are released.

• Partner with procurement and supply chain to identify third parties that now need extended due diligence or ongoing monitoring. Further, connect with any vendors the department uses to conduct due diligence to understand how they are updating their processes to reflect new sanctions.
• Ensure that robust due diligence is in place on any foreign entity that is a planned recipient of corporate donations to identify potential issues and determine whether it is necessary to review any charitable donations or connections (e.g., board memberships) for any relation with a sanctioned entity.

Workforce Issues

Legal and compliance leaders play a key role in shaping the organization’s response and making decisions about how to manage the workforce, including:

• Review planned statements.
• Advise the organization on support and communications for employees in impacted regions on things such as leave or workplace accommodation available to them.
• Identify any employee visa implications considering recent changes and the organization’s visa sponsorship policy.
• Proactively mitigate the potential for increased discrimination, harassment or inappropriate behavior directed at employees because of location, ethnic background, or other factors.
• Advise employees working with sanctioned entities on what parts of their job they can still execute and how. If contracts must be terminated, evaluate the indirect impacts on employees, for example those whose compensation may depend on those contracts.
• Review planned statements put together by the organization’s CSR or corporate communications team to identify any areas requiring guidance in light of recent events.

Cybersecurity

Legal and compliance may be involved in managing cybersecurity risks. Possible actions include:

• Partner with information security teams to review any clauses specific to “war or hostile acts” in cyberinsurance policies, review existing arrangements with cyber incident response providers (including outside counsel), and consider putting providers on retainer if not already.
• Ensure legal is involved in regular tabletop exercises for cybersecurity events. A scenario planning exercise will help stakeholders to identify areas of responsibility and gaps in response capability.
• Communicate evolving standards for cybersecurity protections to third-party vendors, and ensure ongoing monitoring and action – including provisions for termination of vendor contracts if they do not meet standards.