Members of Congress have written to the Chair of the SEC raising their concerns over the SEC final cyber rule, specifically the 4 day incident

← Back to Blog

Members of Congress have written to the Chair of the SEC raising their concerns over the SEC final cyber rule, specifically the 4 day incident reporting timeline.

What interests one with the attention that incident reporting gets is that the ruling has many hurdles in it for organizations to cross to make a material determination of an incident, before it is reported to the regulator. Incident disclosure is required 4 days after it has been determined as a material incident. Materiality is the responsibility of an organisation to define and the level of reporting required by the SEC has been significantly reduced, to remove information that would be detrimental to incident remediation. The ruling only makes disclosure a formal requirement and reporting a material risks to the SEC has been a requirement for several years.

Hackers complete due diligence of their targets, boards of directors, insurance policies in addition to its infrastructure and systems. Hackers could if they chose make incidents public before an SEC registrant, once they have been found. Or as demonstrated by supply chain hacks, registrants have no control over the effects of a compromise on a vendor that materially effects their business. Cyber is not a risk that registrants have ever had much control over.

What is interesting is that while there is a reasonable focus on incident reporting, in ones opinion it is by no means the thrust of the regulation. Material cyber risk management, governance and reporting are the most significant requirements for boards. Anyone that has built and delivered either 1st of 2nd Line of Defence for cyber risk will affirm that cyber risk management consumes 90% of a registrants time and resources for cybersecurity risk management, by extension regulatory compliance.

Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix

#cybersecurity #cyberriskmanagement #cyberregulation #cyberincidentreporting #securitiesandexchangecommission

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7105443087111335936