First American Financial Corporation (FAFC) became the first firm fined by the Securities and Exchange Commission (SEC) for poor quality

← Back to Blog

First American Financial Corporation (FAFC)‚ became the first firm fined by the Securities and Exchange Commission (SEC) for poor quality cybersecurity disclosure controls and procedures, in combination with NYDFS charges for violating cybersecurity regulations. In what I see as test cases for both regulators enforcement powers, the regulatory regime for both New York covered entities (NYDFS) and public firms (SEC).

How long before D&O insurance will pick up on change in the regulatory landscape? With the NYDFS action formed the basis of a shareholders’ derivative suit against FAFC and its board of directors‚ as well as a number of purported consumer class-action lawsuits. Setting the stage for both regulatory action, shareholder and public class actions for failing to manage cybersecurity governance and risk?

What is notable is that it’s the first-ever finding under rule 13(a)-15(a) with respect disclosure controls related to cybersecurity risks following 10 years of warnings. The SEC avoided the need to establish whether disclosure was materially misleading or those making disclosures were culpable, simply focusing on corporate control failures. In my opinion ESG reporting requirements will change this and with the SEC pursuing cyber risk governance regulation, they are setting their sights on the board room.

‘it may be only a matter of time before a company’s cybersecurity risk management systems fall within the regulatory (and plaintiffs’ bar) crosshairs.’

The NYDFS action will be heard later in 2021 and with penalties of up to $1000 per violation (with potentially 100s Million of client records exposed), but with no confirmed hack and loss this will be an interesting case to follow. At what point does liability start and where does it end?

It is clear that 2021 has started with a clear direction of travel for cyber regulation in the US. Executive orders, the US DoD CMMC program, ESG, significant nation state cyber attacks and a failure in Federal and State cybersecurity. One can expect more regulation to follow.

#cybersecurity‚ #SupplyChainRiskManagement‚ #CyberRiskManagement‚ #riskmanagement‚ #compliance‚ #cyberinsurance‚ #insurance‚ #regulatorycompliance‚ #regulatoryoversight‚ #esgrisk‚ #cyberregulation‚ #esgreporting‚ #soc2‚ #defenceindustry‚ #esg

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6814084688785752064