Call us now:
While the cybersecurity community gets engrossed in the SEC Cyber final ruling. A thought should be paid to the enclosed from the Securities and Exchange Commissions Chief Accountant ot the oversight of crypto trading platforms by audit firms. Why? The SEC final cyber ruling has many similarities to Sarbanes Oxley, and requires very careful oversight and assurance by the covered entity and its internal and external auditors. Oversight and assurance that according to the article was not so thorough for the crypto community.
For those of us who have been involved in building and delivering SoX programs or Operational/ cyber risk management programs under Basel Accords. Meeting the requirements set out in the SEC final ruling has many important similarities, challenges and regulatory pitfalls. Least of all the SEC final ruling will be a regulated requirement, one that focuses on materially of cyber risk. Risk that crosses all data types including data that effects material financial statements. Materiality for cyber risk that includes all financial, personal, operational, customer, sales, marketing, engineer and IP data created, owned stored or transmitted by the covered entity.
Compliance to the SEC ruling by public firms will require close oversight, assurance and attestation by covered entities. As with SoX and Basel compliance it will require a 3 Line of Defence assurance program. To oversight and assure cyber risk management through board reporting committees, involving internal and external audit to attest compliance prior to regulatory submission.
However as the enclosed article points out, auditors have been put on notice by the SEC. One only makes the point that financial audit firms will be paying very close attention to the oversight and assurance of cybersecurity risk management, audit practice and the potential for misstatements.
For those entering the ‘lucrative’ cyber market the SEC final ruling has created, be aware. The Final ruling does not (as far as one can see) set out any penalties for non-compliance. Penalties that SoX, GDPR and EU NIS 2 and DORA set out out. The SEC Whistle-blower program, enforcement under the False Claims Act and oversight required under the Securities and Exchange Act 1934 provide plenty of scope for regulatory fines for non-compliance to both the covered entity and their advisors.
The SEC proposal along with EU NIS 2, DORA and Australian cyber regulations create a cyber-legal compliance risks for covered entities.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission #audit
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7090999167459700736