Call us now:
For those following the regulatory developments for cybersecurity risk management, continue to read. Last week under the Securities and Exchange Act of 1934 the Options Clearing Corporation (OCC) filed with the Securities and Exchange Commission (SEC) a proposed rule change for the adoption of a Cybersecurity attestation program. Requiring OCC members to
1. Â Submit a signed confirmation that a comprehensive cybersecurity program and framework is in place. Protecting the confidentiality, integrity, and availability requirements of systems and information.
2. Confirm that the firm has implemented and maintains a written enterprise cybersecurity policy or policies aligned to industry best practice, approved by senior management or the organizations board of directors.
3. Include a representation that if the submitting firm is using a third party service provider or service bureau(s) to connect or transact business or to manage the connection with OCC, the submitting firm evaluates the impact of third party supplier cyber risks.
4. Confirm that the submitting firms cybersecurity program and framework protects the segment of its system that connects to and/or interacts with OCC.
5. Confirm that the submitting firm has in place an established process to remediate cyber issues.
6. Include a representation that the submitting firms cybersecurity programs and frameworks risk processes are updated periodically based on a risk assessment or changes to technology, business, threat ecosystem, and/or regulatory environment.
7. Include a representation that the review of the submitting firms cybersecurity program and framework has been conducted by the submitting firm, or an external qualified auditor.
For those firms covered under Basel accords then compliance may not be a significant issue. The issues is attestation, requiring firms to deliver a completed confirmation on an ongoing basis, at least every two years. With the regulatory compliance and legal implications that brings.
It is clear that U.S. regulators are moving ahead with cybersecurity risk management regulation and oversight, that is significantly different for cybersecurity compliance. One expects to hear from the SEC on their proposals for cybersecurity risk management regulation of public companies. If other current U.S. regulations are a bench mark then I expect a mix of this proposal and NYDFS.
Compliance underpinned by industry standards including NIST SP 800-30, 37r2, 39 and NIST CSF.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #regulation #governance
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6942728258962501632