Call us now:
Ted Dziekanowski seeking to add regulatory compliance and focused delivery targets to executive pay is not a new exercise. However one suspects that cyber related metrics will increase in popularity for public firms in the U.S, as the SEC Final Ruling comes into effect next week. Along with which the data required to demonstrate compliance over material cyber risk and material cyber incidents will provide a rich seam of corporate information for executives and markets alike.
Organizational design to address cybersecurity risk management compliance will change. Cyber risk management reporting will require board and board subcommittees oversight, assure and attest cyber risk management and incident reporting compliance. Requiring a focus on material cyber risk management and the collection of data that will not just be used by the regulators, but by ‘Reasonable Investors’ to make decisions about registrant cyber compliance.
Corporate data will be used by investors to questions compliance, and regulators may review pervious market submissions, as they make a decision on an organizations compliance. One must also consider the role of the regulators Whistleblower program and its effect on corporate compliance. The SEC has a robust regime of regulatory enforcement, in part driven by its Whistleblower program, omissions and commissions become a consideration when submitting regulatory responses.
While we are talking about the SEC final rule today, from the end of 2024 EU NIS 2 and DORA will be effective. Regulations with similar intent and broader scope to the SEC ruling.
Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cyberriskmanagement #cyberegulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7103310519876366337