Are companies adopting a conservative approach to cybersecurity risk management reporting.

← Back to Blog

Are companies adopting a conservative approach to cybersecurity risk management reporting. Or are they taking a safer line with 8K filings for the time being. As the regulator has not yet clearly responded to the information that it has been provided under 8K filings? One suspects that the 8K filings made so far have been out of safety, and to demonstrate willing.

The SEC rule only requires registrants to report a cyber incident after 4 days if they determine an incident has had a material or ‘likely’ to have a material impact on its financial condition and results of operation. Now the kicker here is the term material, the SEC rule states “information is material if ‘there is a substantial likelihood that a reasonable shareholder would consider it important’ in making an investment decision, or if it would have “significantly altered the ‘total mix’ of information made available.

This may explain some of the 8K reporting to the SEC thus far. As covered organisations grapple with the material impact of cyber incidents. Possibly waiting for the SEC to start the process of passing determination on current reports. That will likely require challenge and clarification, and one suspects the SEC is in no hurry to do this.

@Thaddeus Dziekanowski Brian D. McCarthy Rich Waite, M.Ed. George Sawyer

Veritas GRC

National Institute of Standards and Technology (NIST), Ryan Buckner Federal Bar Association Brian Levine Johnathan Rudy

#cybersecurity #cyberriskmanagement #cyberregulation #3lod #cyberattack

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7176189332859293697