Call us now:
Thank you Olaf Classen. See my previous post on Ivanti.
When the ruling becomes effective, Citrix would be required to consider the material effect of the identified vulnerabilities and decide if it has to be reported to the SEC. Remembering the definition of material risk is one that a reasonable investor would consider material and whether the incident is material or ‘likely material impact’.
Covered entities effected by the vulnerabilities will be required to assess materiality or likely material effect of the vulnerabilities to their business, and if considered material report this to the SEC. One suspects that supplier issues will create many challenges for SEC covered entities, under the SEC final ruling.
One should not forget that the regulator has access to the same threat and risk data to make its own judgement on materiality.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission #materialcyberrisk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7092873667121971200