Call us now:
The SEC final ruling is without doubt a significant action. But when one reads it, its narrative and the existing regulation and need of the SEC to protect investors and markets. It is clear that the SEC are enforcing some existing disclosure requirements, focusing on ‘Left of Bang’ material cyber risk, and ‘right of Bang’ material cyber incident disclosure.
Materiality, Reasonableness and Adequacy are core the the ruling. Often missed is that materiality is required to be assessed as far as a ‘reasonable investor’ sees it and there is little case-law that agrees what a reasonable investor is. Materiality disclosure for covered entities is not knew, but one suspects many registrants have not addressed it previously. The further issue is cyber risk and incidents from a script kiddy hack (Lapsus$), through to a Nation State have the potential to cause material harm. So the breadth of scope to identify material cyber risks and material cyber incidents is very broad. Affecting organizations material risks and those of their third party suppliers.
The four day reporting window is often discussed, but the regulation makes clear the clock starts ticking from the point materiality has been agreed, not from the point an incident is identified.
The ruling becomes effective 30 days after it is added to the Federal Register, meaning material incident disclosure could be sooner than many had predicted and reported through Form 8K. With declarations of material risks in annual reports effecting firms from December 2023. Without doubt the SEC ruling will have a significant effect on public companies, including foreign registrants.
For those that want to know about the ruling, its scope, deliverables and how to comply then please reach out to www.augustagrp.com or here. Many will have seen the U.S West LegalEdCenter accredited Bar cyber program we delivered for Attorneys from April to July 2023, that included the SEC ruling and compliance. We will be discussing the SEC final ruling with the The Institute of Internal Auditors Inc. on the 31st August.
Watch for our paper that discusses the ruling and fiduciary implications.
Ted Dziekanowski Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberlegal
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7094963447888527360