Call us now:
A great report by the Harvard Law School Forum on Corporate Governance. Assessing the cybersecurity preparedness of the Russell 3000 companies, ahead of the expected release in Quarter 1 2023 of the SEC proposal on cybersecurity risk management governance, strategy and incidence disclosure. It also opens a window to the cyber compliance challenges ahead for EU firms, as the assessment criteria are applicable to both EU NIS 2.0 and DORA regulations.
The Russell 3000 is a market capitalization-weighted equity index that tracks the performance of the 3,000 largest U.S. traded stocks, which represent about 97% of all U.S. incorporated equity securities and foreign registrants, that includes the S&P 500. The report assesses 11 criteria of governance covered by the SEC proposal, ranging from the number of board members with cyber experience, has the firm yet declared an approach for cyber risk management, cyber training, declared breach’s, is there appropriate committee reporting and is the company audited by external third parties against appropriate cyber standards.
Companies in the Russell 3,000 cover all industry sectors. Explaining for example why some boards have 9 members with cyber security experience (cyber tech), some FIs are regulated to provide annual cyber training and U.S public firms covered under SoX undergoe external audit. But the overall picture is not good, and demonstrates the work ahead if the SEC proposal moves forward. If there were a need to justify the SEC proposal then this report goes some way to doing it.
We have the written the board governance program that addresses the areas that are covered by the report, as summary can be found here.(https://lnkd.in/etQdtn-w)
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission #cybergovernance #cyberlaw #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7006528161949589504