Call us now:
Boards of U.S listed companies have to oversight, assure and attest material risks, irrespective of the SEC Final ruling on cyber for many years. Cyber has always been a material risk, tested to a lesser degree under SoX since 2002.
One believes that the SEC final ruling is more encompassing than the proposed ruling. It places the responsibility on those that create, assess and manage cyber risks to oversight and assure the risk and requires the naming of committees and members with cyber experience, that could include amongst others the audit, compliance, risk, cyber, operations, finance and HR committees. Passing the risk oversight and assurance to the board.
It will be difficult for directors and officers to claim that they did not know or understand the risk. That if disputed could indicate that the appropriate board reporting committee did not assess the risk properly, or the board failed to review the appropriate board reports and ask the right questions, as expected of a Director or Officer. Also lets not forget the ruling itself now public, cannot be ignored. It will be difficult for boards to claim ‘I did not know’ about the duty of care to manage cyber risks, or when challenged in court, ‘what questions did you ask’, as a director of officer of the company to protect shareholders from cyber related risks.
Irrespective, when assuring and attesting cyber risk board members will need to understand the risk, or seek guidance from a NED with cyber experience. One should not forget for international organizations covered under regulations including EU NIS 2, DORA, CRA, FDA, DoD DFARS, or Australian cyber regulations, boards will be held accountable for cyber and cyber risk management.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission #cyberlaw
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7091024112373886976