Call us now:
For boards of SEC covered entities this is a demonstration of the oversight and assurance the regulator places over market reporting, in this case cyber incident disclosure. It also demonstrates the challenges boards can face with clarifying and accurately reporting cyber incidents, through their governance processes.
In July 2020 Blackbaud Inc made misleading disclosures about a ransomware attack. Reporting that the attacker did not access donor bank account information or social security numbers, when the attacker did. Employees did not communicate this information to the senior management responsible for its public disclose, because of a failure to maintain disclosure controls and procedures.
Cyber incidents are complex, time bound and stressful events. However regulators expect timely, accurate and transparent reporting. Cyber incident response processes should be evaluated, tested and re-tested.
The companies August 2020 quarterly filling was found to be misleading and resulted in the company agreeing to pay $3million to settle charges with the SEC. (https://lnkd.in/dy_sSVWj)
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA Jamie Foster
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7039860594031669248