Call us now:
There are many comments on the suitability of cyber regulation, focusing on the role of Federal Agencies and of incident reporting. But all seem to forget that the U.S adopted FISMA under OMB A 130 from 2002. A regulation that if it had oversight and implemented as required from 2002, 2014 and now 2023, may have gone along way towards securing U.S Federal Government infrastructure and introduce cybersecurity risk management and set a direction for private sector cyber compliance. Yet there is little mention of what was done to do enforce this.
What is consistent through the past 18 months is the discussion of the need for cyber incident reporting and the specified time lines. However if one focuses in on the SEC final ruling cyber incident reporting is a fraction of what matters. The assessment and reporting of material risk, the accountability and responsibility of management and boards to oversight and assure material risks on behalf of a reasonable investor, is core to the SEC proposal. Requiring registrants to describe how they manage material cybersecurity risks ‘Left of Bang’, preventing cyber incidents in the first instance. Cyber incident reporting, ‘Right of Bang’, is as a consequence of organizations failing to manage cyber risk and protect their shareholders investments.
What we should not forget is that when a material vulnerability is identified, it is invariably due to a hacker, or developer. If it is identified by the hacker its usually as a result of a hack. If its identified by a developer it’s usually a coding issue due to poor dev ops. If it’s considered material by the developer and/or hacked organisation, then it could be reported only if it is considered a material risk and/ or a material cyber incident (using the bar of a reasonable investor). But lets not forget more vulnerabilities are exposed publicly by hackers than tech firms, to which there is no control irrespective of the incident reporting time line. Ask yourself the question with the latest Ivanti hack. Who would report what and when. The developer or the hacked firm that may have a material incident and risk exposure to its investors, or both for different material reasons?
One wonders if we are in a time where markets forces have clearly failed to address cybersecurity and regulators in the U.S, EU and Australia are having to move to enforce cyber compliance. As there is no other choice and no regulation is ever going to be perfect, as the implementation of FISMA demonstrated over 20 years.
The question is, is cyber regulation messy? Or is it being clarified by ONCD, DHS, DOD, SEC, The EU and Australian regulators? Cyber Incident reporting is reactive ‘Right of Bang’ required when prevention ‘Left of Bang’ has failed.
Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7094683578839539713