Call us now:
The SEC has made several comments recently on the reporting of cyber risks and cyber incidents under its Cyber ruling effective September 2023. Erik Gerding, the Director, Division of Corporation Finance has been especially vocal on cybersecurity risk management reporting under the new rule (https://lnkd.in/eeReQtu6). This week the Director clarified the SECs position on reporting of cyber incidents beyond that which is incident in Item 1.05 of Form 8-K.
One wonders that by releasing the enclosed clarification of material cyber incident reporting, effected companies have not yet understood the compliance requirements to meet the new rule? Or whether covered companies are assessing the legal implications of discussing a cyber incident beyond the reporting of the incident to the SEC, that increases their legal risk significantly. Therefore they do not discuss the incident further, at risk of legal and compliance considerations.
By doing this, is it having an impact on the broader sharing of cyber incident data, or precluding the notification of an incident to affected customers or suppliers which is not the intent of the SEC cyber rule. Non Public information can be shared:
‘for example, if the information is being shared with a person who owes a duty of trust or confidence to the issuer (such as an attorney, investment banker, or accountant)[8] or if the person with whom the information being shared expressly agrees to maintain the disclosed information in confidence (e.g., if they enter into a confidentiality agreement with the issuer)’
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC U.S. Securities and Exchange Commission commission
#cybersecurity #cyberriskmanagement #cyberattack
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7210223030998892544