PARAVA – NEW WEBSITE – SEC FINAL CYBER RULE

The SEC Cybersecurity Rule strengthens expectations for how organisations identify, manage and disclose material cybersecurity risks and incidents. It places cybersecurity firmly within executive and board-level governance rather than treating it solely as a technical or IT responsibility.  The Rule requires covered registrants to disclose material cybersecurity risks and incidents where the information would be relevant to a reasonable investor. Organisations should therefore maintain effective processes for identifying, assessing, managing and reporting cybersecurity risk, supported by clear accountability, incident response, remediation and appropriate escalation to senior management and the board.

Three principles are central to compliance: materiality, reasonableness and adequacy. Organisations must be able to demonstrate how they determine whether a cyber risk or incident is material, whether their response is reasonable and proportionate, and whether their cybersecurity risk management arrangements are adequate.  The Rule also increases the importance of board oversight. Boards should have access to sufficient information, expertise and assurance to understand material cybersecurity risks and challenge management where appropriate.  A defensible approach should be supported by documented risk assessments, governance arrangements, decision-making processes, incident classifications, remediation activities and board reporting.  Ultimately, compliance should extend beyond disclosure. Organisations should establish a risk-based, proportionate and demonstrable cybersecurity governance and assurance framework that enables management and boards to understand, oversee and effectively manage cybersecurity risk.