Yesterdays announcement by the SEC for mandatory cybersecurity disclosure will set the cyber risk management agenda for SEC covered entities, if…

← Back to Blog

Yesterdays announcement by the SEC for mandatory cybersecurity disclosure will set the cyber risk management agenda for SEC covered entities, if passed. Not only does it propose mandatory ongoing disclosures by covered entities of their governance, risk management, and strategy with respect to cybersecurity risks. But note the term ‘cybersecurity risk management’.

The SEC proposal is in line with other market and financial regulators. Operational Risk Management required by banks under Basel 3, and the implementation of Risk Control Self Assessment (RCSA) including cybersecurity risk for capital adequacy evaluation. Risk management is an enterprise wide process of continuous evaluation and improvement from inherent to residual risk, that is distinct from the management of cybersecurity.

This is an important distinction, bringing together the need for organisations to identify and assess enterprise wide risks as they relate to and impact cybersecurity, with the control and mitigation of cyber-risks. The SEC proposal further requires a continuous process of the evaluation and re-evaluation of cyber risks as an organisations threats, vulnerabilities, strategy and financial performance changes. I see the SEC proposal much closer to that required under FISMA and the RMF (NIST SP 800-37) and the likely focus on the adoption of CSF profiles for risk mitigation that the DoDs cyber program.

If the proposal moves forward it may impact the board room of many global brands and their supply chains. It will facilitate a new organisational design with the adoption of Chief Risk Officers (CRO) and Chief Information Security Officers (CISO). It will increase board room accountability for the management of enterprise wide cyber risk and come with a ‘whistleblower program’, and Department of Justice (DoJ) Oversight.

Another significant challenge industry will have to address is the lack of experience and qualified resource in the market to deliver the program.

Ted Dziekanowski Dean Armstrong QC

#theaugustaplan #cybersecurity #cyberriskmanagement #regulatorycompliance #regulatoryoversight #cybercompliance #cyberregulation #cybergovernance #cyberriskgovernance #ransomeware #governance #nist #cscrm #scrm #fisma #riskmanagementframework

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6907592403902152705