Call us now:
The SEC, SolarWinds Corp. case gradually moves forward. A pretrial conference has been requested by both parties for December 14th. As the SEC and SolarWinds disagree over the charges bought.
With the SEC claiming in its October 30th 2023 charges, SolarWinds and its CISO violated federal securities laws through materially false and misleading statements and omissions, and schemes, that concealed SolarWinds’ deficient cybersecurity practices and increasing cybersecurity risks. With SolarWinds claiming that its public filings warned its systems ‘are vulnerable’ to compromise and that disclosing vulnerabilities in controls has never been law or industry practice. SolarWinds claims that any alleged misstatements cannot be deemed material. That alleged “internal accounting controls†violations highlighted by the SEC rest on unsound legal theory and that the SECs statutory requirement that a company’s “internal accounting controls†must ensure that “access to assets is permitted only in accordance with management’s . . . authorization.†applies to payment systems only, and not apply broadly to SolarWinds cybersecurity controls.
Both parties remain unwilling to discuss a settlement and it is unlikely that a settlement is imminently likely.
What is interesting with this request for summary judgement, is when one puts a Sarbanes Oxley hat on and considers its application to financial materiality. The main audited categories of IT General controls focus on all systems that affect financial materiality, and all the associated controls, that includes cybersecurity controls and compensating controls irrespective of who and where they are owned.
Furthermore materiality is not just (even prior to the SEC final rule) an assessment of financial materiality. Covered organization have been obligated to evaluate and report material risk to the SEC, irrespective of those risks that are security related. One raises the question therefore of the Software Development Lifecycle and allegations made by the SEC SolarWinds Software was vulnerable. Was this a material risk to the company and to investors?
The SEC compliance to FISMA, the federal agency standard for cybersecurity compliance. Does this set the bar for adequate compliance already?
One suspects that the SEC SolarWinds Case will continue to be one to watch.
Ted Dziekanowski Brian D. McCarthy
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7140633177043132418