It’s a good question and depends on the lens used.

← Back to Blog

It’s a good question and depends on the lens used. The SEC defined in broad terms the standard of care it expects in their final cyber rule. Requiring regulated entities address the questions of materiality, reasonableness and adequate set out under caselaw. One we discuss here https://lnkd.in/e8u6mj4a

Also following the requirements the SECs is required to adopt under FISMA, is a good starting point for evaluating a standard of care organisation should consider in meeting cyber regulatory requirements. The EU through NIS 2 and DORA set out the baseline requirements for a standard of compliance. Requiring covered entities address adequate cybersecurity risk management. Requirements that are similar to those set our by the SEC.

Standard of care will be tested by the SEC through the SolarWinds case. One suspects more will follow, clarifying regulatory expectations of cybersecurity compliance and the baselines for corporate fiduciary responsibility.

We will be discussing the SEC Final rule next month with the Federal Bar Association. Setting out what we believe are the regulatory compliance requirements, and fiduciary responsibilities of covered entities.

Ted Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Bob Dix

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7135252587099885570