The SEC final cyber ruling may have broad consequences for registrants.

← Back to Blog

The SEC final cyber ruling may have broad consequences for registrants. The SECs decision to focus specifically on cybersecurity as a material reportable risk increases the disclosure requirements of companies such as Toyota from the 5th of September, and the date material incident disclosure starts on the 18th of December. The final rule defines a cyber incident is

‘Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant’s information systems that jeopardizes the confidentiality, integrity, or availability of a registrant’s information systems or any information residing therein’ (p.76 – Final Rule)

Under the final rule form 8 – K requires registrants ‘Describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations’ (p.29 final ruling)

Here in lies a challenge for registrants.
1. A cybersecurity incident is not necessarily related to an attack by a threat actor, that wants to cause harm to a registrant. Systems failures are generally unauthorized occurrences and in the case of Toyota appear to have effected the ‘availability of a registrants information systems’.
2. Reportability would depend on what Toyota defines as a ‘material’ cyber event.

Materiality under the final rule is defined against the bar of what a ‘reasonable investor’ would consider important, triggering an 8-K submission. Shutting domestic production down for 24 hours may constitute a material event for Toyota, as one can argue it is an event that reasonable investor would consider important.

3. Toyota’s assessment of the material impact or reasonably likely material impact of the incident, will decide if the event is reportable.

The final ruling is nuanced, requiring registrants to define certain guide rails by which it assesses compliance. As cybersecurity, risk management and regulatory compliance professionals, we at the Augusta group have designed and delivered cybersecurity and risk management compliance programs. If you would like to know more, please reach out to discuss.

Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix

#securitiesandexchangecommission #cybersecurity #cyberriskmanagement #cyberregulation #compliance

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7102544900750995456