There’s a bit of media attention following Microsoft submitting an 8K filling to the SEC (below), in response to its recent email compromise.

← Back to Blog

There’s a bit of media attention following Microsoft submitting an 8K filling to the SEC (below), in response to its recent email compromise.

There’s conversation about the SEC final cyber rule and material incident reporting. Material incident reporting is not new, the SEC rule only clarifies material cyber incident reporting. The challenge for Microsoft, and other covered companies, is the definitions of material, adequate and reasonable, while supported to a degree by case law (page 14 Securities and Exchange Commission – RIN 3235-AM89) require testing.

The rule says information is material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the ‘total mix’ of information made available.”, “Doubts as to the critical nature” of the relevant information should be “resolved in favor of those the statute is designed to protect,” namely investors.

Rachel V. Rose, JD, MBA, Ted Dziekanowski and I discussed this last year – https://lnkd.in/e8u6mj4a for Bloomberg law.

Materiality will be a difficult bar to assess against. Companies will have to consider the role of the ‘reasonable investor’ to which a definition is difficult to pin down. But one is sure the decision will be evaluate and re-evaluated as compliance to the SEC Cyber rule develops.

Brian D. McCarthy Rich Waite, M.Ed.

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberregulation #cyberlaw

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7155873743506931712