Call us now:
The SEC final rule is effective 5th September 2023, with compliance starting for registrants in December 2023. While we have articulated definitions for ‘materiality’ and the ‘reasonable investor’, there is no formal definition for ‘adequacy’ or what ‘adequate compliance’ to the ruling means.
In the absence of any benchmarks for compliance to the final rule; we address what adequate compliance could look like. Knowing that the SEC complies to existing Federal cyber regulations; adopts a Risk Management Framework; Cybersecurity Framework Profiles; metrics defined by Federal Inspector Generals and follows a path for cyber maturity that is audited annually by the SEC Office of the Inspector General (the SEC eats it own dog food). We make a case that by adopting the same compliance frameworks and standard as the SEC (and the rest of Federal Government), then ‘if it is good enough for the SEC then it is good enough for a registrant’.
Registrants are required to demonstrate cyber security risk management, risk mitigation, governance, oversight, assurance and attestation of material cyber risk and incidents. Unfortunately there are very few paths open for a registrant to demonstrate compliance. Least of all ones that adequately support a registrant through the legal and compliance challenges that may insue, once SEC reporting starts cyber incidents occur and cyber and D&O insurance bails.
Please reach out directly if you would like to discuss the SEC final rule and compliance. We have been working with companies on cybersecurity risk management compliance for a long time, delivering cyber risk regulatory programs.
Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cyberriskmanagement #cyberregulation #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7107780795292889088