Call us now:
Management and CISOs of SEC covered entities should read the enclosed. The SEC filed an opposition to SolarWinds motion to dismiss on the19th of April. As the case heads towards oral arguments next month both sides are presenting their arguments to dismiss (SolarWinds) or take to trial (SEC).
In the enclosed opposition the SEC is clearly focused on the CISO and the knowledge and responsibility the SEC believes the CISO had for the management of cybersecurity of SolarWinds products and services. In the SECs view the cybersecurity issues at SolarWinds were systemic, its security disclosures were false and misleading.
In the enclosed 71 page opposition, the SEC reinforces its position that SolarWinds and its CISO made misleading public statements regarding SolarWinds’ Cybersecurity Practices,
1. The CISO Drives SolarWinds to Post the False Security Statement.
2. SolarWinds Made False Risk Disclosures in Its SEC Filings.
SolarWinds and its CISO Failed to Disclose Red Flags and Warning Signs of a
Cyberattack Leading up to the Revelation of the SUNBURST Cyberattack.
1. Defendants Failed to Adequately Respond to Warnings of a Security Gap.
2. The Defendants Did Not Address Increasing Attacks.
SolarWinds Learned of the SUNBURST Attack, It Did Not Fully Disclose Its Known Impact. The company did not disclose material information important to investors.
This case is going to be one to watch. While it is not being held under the SECs new cyber rule, it is testing the role of management and the CISO over the management of cybersecurity risk by a SEC registrant and material risk reporting that predates the SEC cyber rule. The outcome of which will shape the reporting of material cybersecurity risks and incidents.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner
Veritas GRC SolarWinds U.S. Securities and Exchange Commission
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7188430234520629248