Call us now:
A good read from the World Economic Forum (WEF), discussing the Securities and Exchange Commissions (SEC) proposal for cybersecurity risk management, strategy, governance and incident disclosure. If the SECs proposal makes it to regulation, it is likely to have the same regulatory effect as Sarbanes Oxley.
It will take cybersecurity from a back office function to the board room, focused on cybersecurity risk management and reporting to a capital market regulator. A regulator that feeds credit rating agencies and institutional investors with regulatory oversight. Creating significant challenges for many public firms that require access to US capital.
As the WEF report demonstrates Boards are disconnected from perception of their preparedness and resilience to cyber threats, and the facts on the ground. Cybersecurity may well be a capability that is required on the board table, whether Boards want it or not and of all the board reports cybersecurity risk reporting will be watched very closely by regulators giving the systemic nature of the risk.
Cybersecurity professionals will be significantly impacted by the proposal. The SEC wants ‘cybersecurity risk management’ and this requires both cybersecurity and risk management skills. It won’t be good enough to implement a cybersecurity framework, CISOS will have to report risk and control effectiveness from inherent through to residual risk. NIST or ISO control frameworks are a fraction of the requirement.
Finally close attention should be paid to the SolarWinds case. The legal implications of cybersecurity both on the CISO and Board through shareholder actions and soon to be regulatory oversight are front and centre.
Ted Dziekanowski Brian McCarthy Jason Spezzano
#cybersecurity #cyberrisk #cyberinsurance #departmentofjustice #sec #whistleblower #compliance #cyberregulation #ciso #cyberregulation #legal
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6917032724251709440