Call us now:
A balanced piece on the current state of the SECs enforcement of cybersecurity and what the future could look like, from the Harvard Law School Forum on Corporate Governance.What is interesting is that the article pays little attention to the management and reporting of material cyber risks. The management of cyber risk is foundational to the mitigation and prevention of cyber incidents. Yet cyber incident reporting is what gets everyone excited.Back in 2018 the SEC issued guidance on risk factor disclosures including cybersecurity risk disclosure. https://lnkd.in/ewzY7heGhttps://lnkd.in/eQhsJkprThe SEC final cyber rule simply put the disclosure of cyber risk into a specific reporting category. As the above Alerts from White & Case LLP highlight the reporting of risk factors such as cyber and AI are important considerations to the markets and market regulators. Recent enforcement actions such as those against SolarWinds, United Health and CDK weigh heavily on reporting of cybersecurity risk factors. One would also consider the many congressional hearings of the impact of cybersecuirty on CNI and national security. One has always said that cyber incident reporting is not a major consideration of compliance to the SEC final cyber rule. But demonstrating the management of material cyber risks (Left of Bang) is what really matters, and cybersecurity and AI risks are material risk factors today. @Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Rachel V. Rose, JD, MBAVeritas GRC U.S. Securities and Exchange Commission#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7311335843741196290