On July 26, 2023, the Securities and Exchange Commission (SEC) adopted many of the proposed cybersecurity regulations first discussed well over a year ago to formally insist that public companies improve and demonstrate their cybersecurity rigor.
In very much the same manner that Sarbanes-Oxley (SOX) formalized disclosure methodology for financial reporting, these new regulations place focused emphasis on cybersecurity transparency and accountability for public companies.
These updated regulations demand that public companies explicitly describe how they prepare for cybersecurity threats, including how they evaluate vulnerabilities, monitor inappropriate behaviour, proactively mitigate, respond to, and ultimately remediate threats. These are all components of a professional cybersecurity risk management program and should not be considered onerous.
I believe that the SEC took the feedback gathered over the last 16 months (since the requirements were initially proposed in March 2022) quite seriously and either removed or softened the most onerous compliance components to enact a more tractable solution. So, it’s good to see that the rules have finally been adopted.
Per the SEC’s Final Rule documentation, here’s a summary of the requirements being adopted:
Item |
Summary of the Disclosure Requirement |
Regulation S-K Item 106(b) – Risk management and strategy |
Registrants must describe their processes, if any, for the assessment, identification, and management of material risks from cybersecurity threats, and describe whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect their business strategy, results of operations, or financial condition. |
Regulation S-K Item 106(c) – Governance |
Registrants must:
- Describe the board’s oversight of risks from cybersecurity threats.
- Describe management’s role in assessing and managing material risks from cybersecurity threats.
|
Form 8-K Item 1.05 – Material Cybersecurity Incidents |
Registrants must disclose any cybersecurity incident they experience that is determined to be material, and describe the material aspects of its:
- Nature, scope, and timing; and
- Impact or reasonably likely impact.
An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material. A registrant may delay filing as described below, if the United States Attorney General (“Attorney General”) determines immediate disclosure would pose a substantial risk to national security or public safety.
Registrants must amend a prior Item 1.05 Form 8-K to disclose any information called for in Item 1.05(a) that was not determined or was unavailable at the time of the initial Form 8-K filing. |
Form 20-F |
FPIs must:
- Describe the board’s oversight of risks from cybersecurity threats.
- Describe management’s role in assessing and managing material risks from cybersecurity threats.
|
Form 6-K |
FPIs must furnish on Form 6-K information on material cybersecurity incidents that they disclose or otherwise publicize in a foreign jurisdiction, to any stock exchange, or to security holders. |
The regulations also require C-suite executives and boards of directors recognize these risks, understand risk mitigation plans, and track progress regarding ongoing (and hopefully improving) cyber resilience. These board members will demand better instrumentation to track improvement and as a result, the CISO will find themselves under a brighter spotlight.
Although the original proposals had demanded that the board describe what cybersecurity education and knowledge existed within the board members themselves, they have walked back from this statement. It will likely be sufficient for CISOs to have consistent high-level data flowing up to board members themselves.
Ultimately, the most eyebrow-raising component (the "Four Business Day Incident Response") will demand that public enterprises will need to formally consider cybersecurity risk from the perspective of materiality. Materiality speaks to the need for transparency for investors participating in the public market, in which cybersecurity risks can directly and suddenly impact the enterprise's stock price (and conceivably undermine confidence in the financial system).
In the initial March 2022 proposal, there were concerns that the suggested timeline to disclose an incident was 48 hours, which in the scope of live incident response was universally acknowledged as decidedly insufficient. In the new ruling, the SEC leaves the definition of “material impact” up to the company itself, but they will need to make that definition public. This is important since there’s a fair amount of latitude in determining what is MATERIAL.
For example, “What would a reasonable shareholder consider important in making an investment decision, or would this significantly alter the ‘total mix’ of information made available?” These are BIG questions, especially since so much information is already “priced in.”
Moreover, I expect that as the SEC has formalized the “Four Business Day Disclosure Rule” for public companies, they will enact the same timing later this year for Investment Management firms (for the sake of consistency). Given that Investment Management firms are generally considerably smaller than most public firms, they wouldn’t necessarily have the same strict board structure. So, it will be very interesting to see how these interpretations filter out into the market and how this applies to private investment management firms (where there isn’t the same amount of public disclosure available to their investors).
It goes without saying that since we’ll continue to see more regulations like these being introduced in the coming years, there is some comfort in engaging a trusted security provider who can not only help you comply with these requirements, but more importantly, enable you to become more resilient against sophisticated cyberattacks. Here’s what I recommend:
- Adopt a cyber resilience mindset so you can anticipate, withstand, and recover from even the toughest cyber threats.
- Partner with an external provider that offers 24/7 threat detection and response capabilities to minimize the impact of a cyberattack.
- If your organization is not mature enough for a CISO, opt for a virtual CISO (vCISO) so they can help you evaluate the maturity of your security program and helps you build a roadmap that reduces your cyber risk.
- Have an existing relationship with an Incident Response (IR) provider so you can minimize the time it takes to go back to normal operations. Plus, knowing that you have an IR provider that’s ready to act on your behalf means you’ll be even more prepared to comply with the SEC’s Four Business Day Disclosure Rule.
Cybersecurity risk is an important risk encountered across enterprises – in addition to financial risks such as counter party risk, forex risk, and many others. It's high time that regulators formally recognize cyber risks as such and hold publicly companies accountable for materially serious and substantial threats in the cybersecurity realm.
