One is interested to read about the opposition to cyber regulation, as it focuses on cyber incident reporting.

← Back to Blog

One is interested to read about the opposition to cyber regulation, as it focuses on cyber incident reporting. One wonders if we’re missing the point. Cyber incident reporting is not the issue at hand, the bigger issue by far is the management of cybersecurity risk ‘Left of Bang’. If companies do not proactively manage cybersecurity risks there are bigger risk to national, economic and societal security.

Under the SEC final cyber rule, the management and disclosure of material cyber risks and demonstrating appropriate governance and oversight is what is important. Reporting material cyber incidents is incidental, especially when one considers that hackers have demonstrated their willingness to share data about attacks publicly.

When one reads that the SEC rule is “wholly unnecessary” and promotes overregulation that will confuse and weaken security teams. One is concerned. Are we accepting there is no need for companies to govern and oversight cybersecurity risk management? That is simply not the case. Iif you don’t manage cyber ‘Left of Bang’ you will not manage cyber. That is the bigger purpose of the SEC final rule.

Another observation is that EU cyber regulation under EU NIS 2 and DORA will regulate cyber ‘Left of Bang’ and affect ICT vendors, that U.S public firms rely to manage cybersecurity risk. There is no avoiding compliance to cyber risk management.

Ted Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Bob Dix

#cybersecurity #cyberriskmanagement #securitiesandexchangecommission

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7132740446010658818