Call us now:
An interesting article on what CISOs should report about an incident. Here is my take, as someone who has been a counsel appointed cyber expert and witness and an executive that has led regulatory reporting of cyber incidents.
The first observation for all those involved in cybersecurity is to read and understand the SEC final cyber rule, last weeks charges filled by the SEC against the SolarWinds and the NYDFS update. The terms material, adequate and reasonable have legal definitions (Rachel V. Rose, JD, MBA you have picked me up many times on this), that a CISO is not professionally qualified to decide, leave that to the lawyers. Should anything ‘go sideways’ and end up in court, internal and external counsel are key and should decide what is important with the CISO and Board. The SEC final rule sets out material incident disclosure and periodic reporting, to provide updates as incidents develop.
Here is a breakdown of the ruling – https://lnkd.in/gtvkFKQm
Defining materiality is key, covered registrant should adopt an approach consistent with caselaw, while recognizing that the SEC sets out guidance on what it expects to be included in an 8K filing under section 1.05 (https://lnkd.in/gF_yd_mC), never mislead, modify or change information as a civil or criminal investigation my result from the incident. Let the lawyers decide what is required supported by the CISO and board. For example defining what is a ‘reasonably likely material impact on the registrant, including its financial condition and results of operations’ is not in the purview of the CISO. As the SolarWinds charge demonstrates, raising communications going back 5 years.
In ones view the CISO works with General Counsel and the board in deciding what should or should not be reported to anyone inside or outside of the organisation. Leaving all incident communications and reporting to the board. Incident reporting is foremost a legal compliance issue that the board is responsible for.
Good Hunting.
Ted Dziekanowski Brian D. McCarthy Bob Dix
#paravasecuritysolutions #cybersecurity #cyberriskmanagement #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7128123249174986752