Call us now:
Thank you for posting Andrew Heighington and commenting Richard (Dick) Brooks.
The Lockheed Martin 10K filled on the 23rd January is an important read. As one of the first annual reports to filled required to address the SEC Final Cyber rule, it sets a baseline for cyber regulatory reporting. Here are some of ones observations about the filling, as it relates to cybersecurity risk management and the SEC final rule.
The first observation comes when one compares the FY 2022 and FY 2023 10K submissions, apart from the repetition across the annual statements. There is a noticeable difference in how many times cyber is mentioned between the years 41 vs. 70.
FY 2023 has a considerable cybersecurity section, 1C. That describes the boards oversight of cybersecurity. The company confirms it must comply with DFARS related to the protection of CUI and be prepared for CMMC compliance. Cybersecurity risks are included in its ERM program, but it does not describe explicitly its material cyber risks, any committees (if any) that oversight cybersecurity risks or threats other than the board. It describes the CISO as having extensive experience but it does not disclose any other senior leaders that provide oversight and assurance of cyber risk, the risk or audit committee members for example, or the cyber experience of other senior management.
It is a challenge to provide the information necessary to satisfy the SEC reporting requirements. However, one wonders if a reasonable investor is any the wiser as to whether the company is more or less secure. Other than resourcing, contractual cyber and third party supplier risk, (DFARS/ CMMC) what material cyber risks have affected or are likely to affect the company. Playing devils advocate Lockheed Martin has been hacked a few times over the past 10 years.
Ted Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #cybergovernance
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7156005477183623168