Call us now:
One suspects the outcome of the Wells notices from the Securities and Exchange Commission (SEC) against SolarWinds, will decide the next course of action for civil action against the company. The SEC will be examining the cybersecurity posture of SolarWinds leading up to the 2020 hack, and what reasonable and appropriate actions the company took to manage cybersecurity and mitigate cyber risk.
No doubt the SEC will look at what the board knew about the organizations cybersecurity posture prior to the incident. Statements made by executives about cybersecurity, and subsequent information from individuals stating the level of cybersecurity maturity at the time of the hack. Taken in the broader context of protecting shareholder value and managing material financial risk.
One suspect that as SolarWinds is governed by Sarbanes Oxley and both Process and IT General Controls will have been assessed and attested annually. Controls including Access to Programs and Data (PDPC), Program Design and Program Change (PDPC) and Computer Operations (CO) would have been attested by a senior executive of the board. That in themselves would have been a reflection of the management of security controls.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #cyberlegal #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7079386287052316672