Call us now:
The die is starting to be cast as companies start to file their 10Ks under the SECs new Cyber rule. The requires companies discuss their cyber governance, processes, accountabilities and responsibilities for oversight, appropriate roles and responsibilities and importantly material cyber risks.
In the enclosed 10K, Schlumberger (SLB) has provided a cybersecurity update in section 1C and its material cyber risks in section 1A. Acknowledging in general terms that cyber presents a material risk to the business. There is no assurance the company will be able to prevent or detect material consequences from cyber incidents, that is a fair statement. Although the company under takes an annual third party assessment against NIST and ISO cyber standards. If there were going to be a material cyber risk smoking gun there isn’t one. The 10K cyber submissions so far are generally boiler plate, with little information in ones opinion that helps a reasonable investor make a decision about cyber. Maybe time will tell.
There is information but it is light on material risk, risk management processes and corporate governance. With little about the process the board follows for cyber risk management, the skills and experience of those that oversight, assure and attest cyber, such as the 2nd and 3rd lines. Is it reassuring that the Board of Directors reviews cybersecurity risks at least annually?
As discussed in the Wall Street Journal (https://lnkd.in/eCUvuPJk). One suspects the man on the Clapham Omnibus maybe left feeling a little short on information. In order to make a reasonable decision about corporate cybersecurity risk management.
Ted Dziekanowski Brian D. McCarthy George Sawyer Rich Waite, M.Ed.
Veritas GRC
#cybersecurity #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7157410363339120640