Call us now:
Many have commented on the SEC final ruling and will continue to unwind the regulation. One has read the ruling many times and as someone who has interpreted and delivered many cyber, risk and information security regulations over the years. The SEC deserves more than an ‘F’, only time will tell whether it is a A, B or C, but F nah. What is clear is the rulings (as per the proposal) focus on ‘materiality’, a ‘reasonable investor’ and what could be considered ‘adequate’ compliance.
The points raised in the enclosed article are an opinion, requiring an understanding of the SEC approach to regulation. Balancing comments made against the proposal and the needs of the SEC to meet its commitments to protect investors, markets and capital formation. One would argue that the final ruling provides the regulatory oversight and assurance of market registrants. Requiring registrants to assess, manage and report ‘material’ cybersecurity risks and incidents as seen by a ‘reasonable investor’; the processes board committees are informed of cyber risks; describe the boards oversight of risks from cybersecurity threats; identify the committee or subcommittee responsible for cyber risk assessment; the experience of individuals that inform boards of material cyber risks; disclose cyber processes; whether risk from cybersecurity threats is reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition of the registrant. All under the bar of what a ‘reasonable investor’ considers ‘material’.
By these definitions the final ruling increases the complexity of oversight, assurance and managements obligations or registrants to comply to cybersecurity risk management. Given what we know about the maturity of many registrants it increases board liability for the management of material cybersecurity risks and incidents. Raising questions of the cyber knowledge and experience of board committees. Whilst leaving the mechanics of cyber oversight and assurance with management. Providing material risk information to investors, so they are able to make a reasonable judgement as to the management of cybersecurity of the registrant.
An ‘A’ it may not be, but an ‘F’? One waits for the SEC to start to pass judgement on filings on incident disclosure and material risks, and the use of the SECs ‘Whistleblower program’, that has proven to be effective. Registrants, at the very least, will have to demonstrate what is or is not material and reasonable. Taking adequate steps to mitigate ‘material’ cyber risk as they report ‘material’ cyber risks and incidents to a ‘reasonable investor’.
The Augusta Group (www.augustagrp.com) will release its own opinion of the final ruling in due course.
Ted Dziekanowski Bob Dix Rachel V. Rose, JD, MBA Neil Humphreys
#cybersecurity #cyberriskmanagement #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7094590914970411008