Call us now:
A great thorough summary of what US public firms can expect if the Securities and Exchange Commission (SEC) cybersecurity proposal makes it into regulation without significant modification. For Foreign Private Issuers note the Summary point 5, as the proposal applies where the Foreign Private Issuer rules apply.
Covered entities should start to consider now.
1. Their cybersecurity governance: The SEC wants to know the boards cyber expertise. The roles, responsibilities and reporting lines of the cybersecurity organisation.
2. Their cybersecurity risks: The detail required by the proposed amendments requires substantial disclosure of a registrants cybersecurity risk management policies and procedures that are used to assess material cyber-risks.
4. Litigation Risks: The proposed amendments require cyber incidents to be reported within 4 business days of determining that an incident is a material. Other regulations require CNI providers to report cyber incidents to CISA in under 3 business days, 1 day for a ransomware attack. (Note the recent DoJ and DoT cyber programs)
5. Management of Third Parties: The proposed amendments would create additional compliance risks for registrants who rely upon third party service providers for information technology services,†as the proposed amendments govern all information resources owned or used by the registrant.†Organisations should have a clear understanding of their data, where it is and who manages it.
If the proposal is passed then the impact of SEC covered entities will be significant and enforce cybersecurity and risk management in the board room.
Ted Dziekanowski
#securitiesandexchangecommission #cybersecurity #cyberriskmanagement #governance #cscrm #scrm
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6911245015264411648