This is definitively a read from the Wall Street Journal ( We may have a case that raises the question of ‘Adequate’ cybersecurity risk management

← Back to Blog

This is definitively a read from the Wall Street Journal (https://lnkd.in/eUKrqh-v). We may have a case that raises the question of ‘Adequate’ cybersecurity risk management compliance, as SolarWinds comes out fighting over last weeks SEC charges against the company and CISO.

This is going to be one to watch as it could create caselaw, especially around the adoption of cybersecurity standards such as the CSF, 800-53 and FedRAMP compliance. The statements made to investors and the oversight and assurance of cybersecurity risk management.

In a response laid out in the article below SolarWinds refutes the charges made by the SEC. One suspects SolarWinds will have its chance to demonstrate it had adequate cybersecurity controls in place at the time of the attack, its adoption of the NIST CSF and reference to NIST SP 800-53 and FedRAMP.

I do not envy anyone involved in this case. CSF and 800-53 are complex as is the evaluation of what should be considered adequate and effective. SolarWinds are alleged to have evaluated 300 controls and their maturity (page 16 of SEC charge). One suspects that these evaluations may be examined closely if the case continues.

The CSF predicates itself on risk management.

Ted Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Bob Dix

#theaugusatgroup #cybersecurity #cyberriskmanagement #solarwinds

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7128299001115750400