Call us now:
The challenge that many governments are now starting to acknowledge is that market forces alone have not worked in managing cybersecurity risk, especially when it comes to CNI. CNI accounts for most of our important industry sectors.
Cybersecurity risk management is at the top, or very near the top of the US political agenda and cybersecurity it is being regulated. Regulation that includes the management of cybersecurity risk, strategy, governance and incident disclosure. The SEC proposal to regulate corporate cybersecurity is one example and will mandate cybersecurity compliance for US public companies. But as is proven with Financial Services regulation, a ‘stick’ alone does not work, unless its backed by enforcement, and a ‘carrot’.
Underpinning the SEC proposal are two programs that give the regime more ‘teeth’. The first is the DoJs civil cyber fraud initiative and the use of the False Claims Act (FCA), applied to companies that provide products and services to Federal Governments. The second is the use of the SECs and DoJs Whistle-blower program, that provides independent transparency into an organisation and its board room.
The proposal has similarities to Sarbanes Oxley and while there is no corporate ‘carrot’ for cybersecurity, the current regulatory regimes for cybersecurity will increase transparency and drive cybersecurity compliance in the US. Programs such as the DoDs DFARS/ CMMC initiative drive cybersecurity into the international DIB, impacting the DoDs Global supply chain. So they are likely to be felt outside the US.
Ted Dziekanowski
#cybersecurity #cyberrisk #cyberinsurance #departmentofjustice #sec #whistleblower #compliance #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6916669111997464576