Call us now:
The SEC final rule sets out clear accountabilities and responsibilities for cybersecurity risk management oversight, assurance and attestation by boards, board subcommittees and accountable executives. As the Uber case demonstrated the CISO is an accountable executive. The board will be reporting the companies material cyber risks and material cyber incidents to the regulator and investors. Requiring an assessment of the registrants cyber risks and program of risk mitigation. A program that is led, in part by the CISO.
As the ruling is written and case law has demonstrated so far, boards and CISOs will be formally required to demonstrate, the company understands and is managing its cyber risks.
CISOs in the EU will face a double impact, not only will some be impacted by the SEC final rule, they will also be impacted by EU NIS 2 and DORA. That regulate cybersecurity risk management in equal measure. With allot of discussion of the role that D&O and cyber insurance play in regulatory breaches, it is looking increasingly unlikely that boards or accountable executives will be able to rely on insurance to cover personal or corporate losses.
Ted Dziekanowski Bob Dix Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #securitiesandexechangecommission #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7111960704361852928