Call us now:
A nice update on disclosure requirements of the SEC final cyber ruling. While many have focused on the cyber incident reporting, in ones opinion its the cybersecurity risk reporting that is the real issue, as discussed and required in the 10K reporting.
As one unpacks the SEC ruling it is clear that covered entities are required to have clear understanding of materiality, reasonableness and adequacy, when assessing cybersecurity risk management compliance and incident response. Incident response is a small fraction of the work load required by covered entities. Demonstrating management, oversight and assurance of cybersecurity risks requires significant effort.
The use of the 8-K report is also important, to capture material, near real time (4 days) incident disclosure. Incident disclosure that is material and could be due to a third party.
Watch for our critique.
Ted Dziekanowski Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberincident #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7094234540059021312