Call us now:
The Securities and Exchange Commissions (SEC) final ruling takes a little reading. In ones opinion created a balanced and well thought through regulation, addressing the concerns raised by the original proposal with the need to protect investors and markets. From a regulator that has to comply to FISMA, and eats its own ‘Dog Food’.
As someone who has spent 20 years working to assess information security, risk and cyber regulation and build the capabilities to manage cyber risk. It does a good job of enforcing existing capital market regulatory requirements; aligning to ONCD national cyber strategy; and meeting the objectives of the SEC to Protect investors. Maintain fair, orderly, and efficient markets. Facilitate capital formation.
The final ruling is not magic and is not vague. It aligns to existing regulatory requirements that pertain to materiality, and the role of an adequate shareholder/ investor. Regulations that have been in place for some time. The Sarbanes Oxley Act adheres to the principle of materiality for financial reporting. The term reasonable investor is not new and used to ensure that covered organizations assess and report the materiality of cyber risk incidents to an existing bar.
What the ruling is, is both objective and subjective. It is objective in that it aligns to existing and new cyber regulation that is clear. It is subjective in that it requires covered entities to make a valued judgement on the role of what is material, the markets and the views of a reasonable investor. This will be a challenge to covered entities, as cyber attacks however small can have a material impact, and reasonable investors are becoming better educated when it comes to cyber. Much could be material and allot could be reportable to a reasonable investor.
The final SEC ruling is typical of cyber risk management regulation, that sets the boundaries in which to operate. Then requires those covered to demonstrate their compliance, that is then tested by the regulator. Sarbanes Oxley, Basel accords, NYDFS, FDA medical cyber device regulation follow a similar approach and EU NIS2 and DORA coming into force in 2024 do the same.
The ruling is not vague, it defines the rails in which covered organizations are expected to demonstrate they comply, and here in lines the challenge.
Ted Dziekanowski Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberlegal #securitiesandexchangecommission
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7093893377636581376