Call us now:
With the SEC final cyber rule effective, what lens will be used to evaluate the SolarWinds cyber incident of 2021? The SEC final rule was not effective at the time, but the SEC has always required covered entities to oversight, assure and attest material risks.
With the recent Wells notices issued against the company, its directors and accountable executives the steps taken next by the SEC may be ones to watch. As the recent national Cyber Strategy and Federal Agency cyber converge around national Security, a convergence that that the SEC is no immune to, nor its registrants. As the U.S national cybersecurity and EU cyber regulations focus on CNI providers that include cloud vendors.
Ted Dziekanowski, as you have said and presented many times, the road to cybersecurity will ultimately lead to the cloud. Creating challenges for compliance oversight, assurance and attestation to the SEC final rule. The cloud is a dynamic environment and continually evolving for many organizations that adopt it. ‘Visibility in the cloud is inherently reduced, which regularly challenges your ability to audit those environments effectively for cybersecurity.
The SEC final rule requires covered entities to oversight and assure material cyber risk and incidents. Material risks the SEC is clear covers third party suppliers such as cloud. ‘A material incident such as what happened with SolarWinds would theoretically need to be disclosed by all companies that made use of the vulnerable SolarWinds Orion software in their environments, not just SolarWinds itself’.
Covered entities face challenges with cloud, the shared responsibility model places many controls at their feet, not just those of cloud providers. Making cyber risk oversight and assurance a real time activity on prem and off.
Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cloudsecurity #cyberriskmanagement #securitiesandexchangecommission #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7105087222718050304