The long anticipated final cyber ruling for SEC covered registrants goes into effect tomorrow, the 5th of September 2023 with compliance reporting

← Back to Blog

The long anticipated final cyber ruling for SEC covered registrants goes into effect tomorrow, the 5th of September 2023 with compliance reporting starting in December 2023, affecting U.S domestic and Foreign Private Issuers. The ruling transfers cyber risk into the board rooms of covered registrants, through regulatory compliance and enforcement. The transfer of cyber risk into board rooms will necessitate registrants demonstrate they are managing cyber risk.

Compliance to the final rule has not been tested, but evaluation of the rule demonstrates increasing legal and compliance risk for Registrants, Directors, Officers and accountable Executives. As set out recently by several U.S law firms specializing in insurance and whistleblower law, the legal and compliance risk that results from regulatory compliance disclosures, and the effects of the ruling on cyber and D&O insurance may be significant.

In our enclosed paper we examine the final cyber rule, the effects of key definitions requiring covered entities to disclose material cyber risks and material cyber incidents in sufficient detail, for a reasonable investor to understand. We define what adequate compliance to the ruling may mean and set out a potential framework for regulatory compliance. The framework if adopted enables registrants effectively disclose their oversight, assurance and attestation of material cyber risks and material cyber incidents to the regulator and financial markets. It is interesting to note that the information disclosed could conceivably be used against a registrant in the event a registrant reports a material cyber incident, that results in a tort.

This paper is written by cybersecurity, risk, legal, education and government affairs professionals with over 70 years of combined experience. Working at the highest levels in cybersecurity risk management, regulatory compliance, cyber and risk education, regulatory oversight and cyber risk management organizational design.

If you have any questions about the final rule, its effects on corporate governance, compliance and cybersecurity risk management please contact me.

Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix

#cybersecurity #cyberriskmanagement #cyberregulation #securitiesandexchangecommission

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7104165969857503232