Call us now:
The SEC proposal for cybersecurity risk management, governance, strategy and incident disclosure is getting air time and column inches. What surprises me is the conversations about the timeliness of incident disclosure and content shared with investors, which is important. But is it the most significant part of the proposal?
I would suggest that the ‘left of bang’ compliance requirements to implement a cybersecurity risk management framework; for boards to declare their cybersecurity experience; for boards to demonstrate oversight and assurance of cybersecurity; demonstrating the alignment of cyber strategy to business goals and reporting policies and procedures are more challenging requirements.
They play a much larger part of cybersecurity compliance and risk mitigation than ‘right of bang’ incident response. They are also more likely to increase legal and regulatory risk and be challenged in court in the event of a cyber incident, irrespective of the incident being reported after 72 or more hours. Regulatory proposals that seem to get less air time.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #cyberregulation #securitiesandexchangecommission #governance #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6963852781203947520