The SEC has now finalized cybersecurity risk management for companies covered under the Securities and Exchange Act 1934, that includes foreign€¦

← Back to Blog

The SEC has now finalized cybersecurity risk management for companies covered under the Securities and Exchange Act 1934, that includes foreign registered companies. It is a significant cyber regulation, with global, cross sector impact. A regulation that if past SEC enforcement is any indication, will have a significant cost of compliance on covered entities.

While one will write a detailed assessment of the regulation in due course, there are some notable points. The first is that while there is allot of comment on incident reporting timelines, yesterdays webinar by the SEC made clear that there will be checks and balances put in place by U.S Federal agencies to protect national security, and the security of those organizations that undergo and report cyber incidents. The fact remains that once a cyber attack takes place, any organisation involved loses all control over reporting.

The second point is the regulation is about material cyber risk management, it is not about cybersecurity. It will require organizations to focus on the evaluation and management of cyber risk (note the reference to FISMA and the RMF). Informing the SEC of their processes for cyber risk management, and demonstrating a reasonable approach to risk management.

Governance didn’t escape regulation. While boards are not the main focus of the regulation, organizations will be required to identify and report on suitably experienced individuals and oversight committees to the regulator. Demonstrating board reporting of cyber risks. All forming the basis of cyber governance.

One is clear that while attention is paid to incident reporting, it is not the most significant issue public firms face. Left of Bang regulatory compliance, demonstrating organizations manage cyber risks and the appropriate governance are more significant than reporting cyber incidents. Given the need to manage cybersecurity in response to economic and national security concerns and better inform investors.

One wonders the effect of the final ruling on cyber insurance Gerry Kennedy

Watch for our evaluation of the regulation, how to assess material cyber risk and implementation program in the coming weeks.

Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA

#cybersecurity #cyberriskmanagement #securitiesandexchangecommission

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7090278476770889728