Call us now:
An example that demonstrates the need for harmonisation of cybersecurity risk management across Federal Agencies. As Federal agencies move to regulate cybersecurity, that increases the burden of incident reporting and drives the need for harmonization of cyber incident reporting.
Cyber regulation brings into scope organizations that have traditionally been unregulated. By example the SEC final cyber rule is industry agnostic and requires material cyber incident reporting in 4 days. Those U.S firms in CNI or Financial services trading in or with the EU face incident reporting within 24 hours of identifying a ‘significant’ incident. That is in addition to complying to similar cyber risk management requirements to the SEC cyber rule.
There is a need to harmonize cybersecurity risk management compliance within and between the U.S and its partners. However, current cyber risk compliance requirements are similar, and can be met through the same compliance program. There is no need to deliver different cybersecurity risk management programs, the same is true for cyber incident reporting. There are different reporting timelines, but aiming to comply to the highest bar in the first instance enables compliance to all regulators.
One suspects following the recent action bought by the SEC against SolarWinds, the issue is not one of regulation or incident reporting for most companies. The issue is one of demonstrating that boards have historically met their fiduciary responsibilities for managing cybersecurity risks. The charges bought by the SEC against SolarWinds are an indication of the regulatory oversight challenges covered companies will face demonstrating cybersecurity risk management regulatory compliance, not one of cyber incident reporting timelines.
Ted Dziekanowski Brian D. McCarthy Bob Dix Rachel V. Rose, JD, MBA
#paravasecuritysolutions #cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7125768309295181824