Call us now:
A nice article that outlines the challenges ahead for cyber regulatory compliance.
Be it the SEC final rule, EU NIS or DORA, they all have common themes of cybersecurity risk management, board oversight, assurance and attestation and regulatory reporting of cyber risks. Underpinned by civil and criminal liabilities. All cyber regulations transfer cyber risk ‘Left of Bang’, back onto the financial statements of covered entities.
The SEC rule in ones opinion is the most challenging regime to comply. It sets the bars of materiality, reasonableness and adequacy for board cyber risk compliance. Providing scope for covered organization to define what is material, the role of a reasonable investor and what adequate compliance means to them and their shareholders. Bars that can be defined and managed and documented by covered entities, and in the worst case demonstrated in the event of a legal challenge.
It is not possible to manage all risks, but it is possible to demonstrate adequate compliance, federal regulators are require to do it. If covered entities eat the same ‘dog food’, they can present a reasonable argument that they are adopting an adequate approach for cybersecurity risk management. There is an approach to demonstrate an adequate standard of care.(https://lnkd.in/eXPVxrUw). I hear dog food tastes quite nice.
Ted Dziekanowski Bob Dix Brian D. McCarthy Rachel V. Rose, JD, MBA
#theaugusatgroup #cybersecurity #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7120311664440168448