Cyber risk management oversight will be a focus of SEC examination in 2024.

← Back to Blog

Cyber risk management oversight will be a focus of SEC examination in 2024. With the continual increase in cyber attack frequency complexity and severity of impact. We will see covered entities undergo cyber attacks in 2024 and declare material cyber incidents. Whose cybersecurity maturity will be assessed against their material cyber risk submissions in their annual returns.

The SEC has the specific tools under the final ruling to focus on
1. cybersecurity (specifically, registrants’ policies and procedures, internal controls, oversight of third-party vendors governance practices, and responses to cyber-related incidents, including ransomware attacks);
2. practices to prevent interruptions to mission-critical services and operational disruptions;
3. protection of investor information, records, and assets, including practices related to safeguarding of customer records and information at branch offices;
staff training regarding cybersecurity and customer data protection;
4. practices to promote cyber resiliency;
5. concentration risk associated with the use of third-party providers, and registrant visibility into the security and integrity of third-party products and services; and
6. preparations associated with shortening the transaction settlement cycle as of the compliance date of May 28, 2024;

We see an increased threat associated with concentration risk. As third part vendor cyber attacks are on the increase, affecting many customers. As the recent cyber attack on UK MSP CTS demonstrates.

Ted Dziekanowski Brian D. McCarthy

#cybersecurity #cyberriskmanagement #securitiesandexchangecommission

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7137362557912150016