Call us now:
Go eat the same ‘dog food’ as the SEC if you want to comply to the SEC Final Cyber Rule.
The cyber rule is foremost a legal and compliance issue that requires organizations demonstrate cybersecurity risk management. It’s not a cybersecurity problem to be managed. The challenge for covered entities is there’s no simple, quick and easy ‘fix’ to compliance. It requires organizations to demonstrate their understanding of materiality, adequacy and reasonableness.
Nearly every column inch one reads about the SEC final rule focuses on material cyber incident disclosure and here in lies a problem, that has plagued the SEC cyber rule since it was proposed. Material cyber incident reporting is a small part of compliance, it’s probably less than 20% of what matters for covered entities in the short term. The remaining 80% requires covered firms demonstrate oversight, assurance and attestation of their material cyber risks. The processes they follow to manage these risks and the governance they have in place for accountable executives and boards to attest material cyber risks management. That will be used by reasonable investors to assess a covered entities ability to manage cybersecurity, before an incident takes place. The fundamental reason the SEC introduced the rule, is they expect companies to demonstrate they can manage cyber risk ‘Left of Bang’.
In complying to the rule one only has to consider what the SEC is required to do to comply with FISMA. As we wrote covered organizations should review the SECs annual FISMA audit (https://lnkd.in/ePK_DQb4) to understand the process the SEC follows to comply to cybersecurity risk management.
Covered entities only have to ‘eat the same dog food’ as the SEC to demonstrate ‘adequate’ compliance. Being prepared to demonstrate to the regulator, potentially in a court room, that legal and regulatory compliance has been reasonably met.
We have presented this approach to the Federal Bar Association, ECIIA | European Confederation of Institutes of Internal Auditing, The Institute of Internal Auditors Inc. and others over the past 3 months. That is discussed in our paper – https://lnkd.in/eXPVxrUw
Understanding what to do is the easy bit, the hard bit is complying with what is required. It is foremost a legal and compliance program not a cyber issue.
Ted Dziekanowski Brian D. McCarthy
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7142981007367892992