Call us now:
A great site for those wanting to keep track of 10-K filings under the new SEC cyber rule. With the number of firms reporting in Quarter 1, cyber attack frequency, complexity and severity increasing, there’s plenty of data making itself available to evaluate organizational cybersecurity risk management.
The reports are interesting. Demonstrating the breadth and interpretation of the final rule. There are reports that simply say under section 1C – Cybersecurity – None (one cannot fault the honesty). Many do not disclose their material cyber risks; some boards review cyber risk annually, others quarterly; some operate a comprehensive risk based approach to managing cyber risk, yet meet to discuss annually. Some companies in tech development have no cybersecurity. Some organisations refer to the 3rd Line to oversight and manage cyber risk. Just a tip, the 3rd line is a assurance function, it does not or should not manage anything, that’s the role of the 1st line, supported by the 2nd. Indicating that governance could be improved.
There are good examples, one healthcare provider is more forth coming with its reporting. Declaring breadth and depth of cyber oversight, assurance and attestation, material risk disclosure, certifications, board expertise and leadership. However one suspects this is the exception and not the norm.
Thank you for pulling this together Andrew Hoog.
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7169991244192944128