Executives to Enhance Cybersecurity Obligations in Line with SEC Disclosure Regulation: Deloitte
In a bid to enhance cybersecurity preparedness and transparency, the Securities and Exchange Commission (SEC) has passed a new rule that mandates public companies to report material cybersecurity incidents within four business days. This rule, effective as of September 5, 2021, is part of a wider effort by federal authorities to promote greater transparency and accountability regarding cyber risk among U.S. companies.
According to a poll conducted by Deloitte, more than half of executives plan to push their third-party vendors to strengthen their cybersecurity programs. Others are strengthening existing governance practices through board education or enhancing cyber risk assessment capabilities. Some organizations are evolving cyber incident response capabilities by defining a process for assessing materiality.
The new SEC rule requires companies to disclose material cybersecurity incidents via Form 8-K without unreasonable delay. Materiality is determined by considering the incident's impact on the financial condition, operations, or business. Companies must also detail their cybersecurity risk management strategy, board members’ cybersecurity expertise or the lack thereof, and third-party cyber risks in their annual 10-K filings. Boards bear direct accountability, and companies must disclose if third-party breaches materially impact operations.
The rules emphasize good faith compliance demonstrated through established internal controls and prompt materiality analysis. While certain legal challenges and political opposition to the rules have emerged, they have not been rescinded as of mid-2022.
The SEC disclosures, which mandate filings for incidents and annual filings on cyber risk strategies and governance, will be required starting in mid-December. Companies that fail to comply risk fines up to $35 million per violation.
Recent cybersecurity breaches have highlighted enforcement challenges, and the SEC has begun cracking down on companies that provided misleading information or covered up significant issues with cybersecurity risk. For instance, the SEC notified the CFO and CISO at SolarWinds of possible enforcement in a civil investigation into statements made about cyber risk prior to the Sunburst attacks.
Many companies, in fear of reputational harm and additional extortion, often paid off criminal hacking groups and failed to make disclosures about the attacks to investors, customers, or the government. However, under the new rules, companies must provide information on timing, nature, scope, and actual or anticipated impacts but need not disclose sensitive technical details that might compromise remediation efforts.
In the wake of these new rules, approximately 70% of companies were not disclosing ransomware attacks to any government agency. However, since the rule took effect, companies like MGM Resorts, Caesars Entertainment, and Johnson Controls have disclosed major attacks.
A majority of executives said their companies have been planning to make changes in anticipation of the new SEC rules. Companies are working to mature their cyber risk programs to enable faster incident response and closer interaction between the CISO, the C-suite, and corporate directors. Corporate stakeholders want to better understand the risk calculus of their technology stacks, in response to the question: Are we a target?
In conclusion, the new SEC cybersecurity disclosure rules require publicly traded companies to promptly and transparently report material cybersecurity incidents, integrate cybersecurity oversight into board responsibilities, and manage third-party cyber risks, or face substantial penalties. These rules are a significant step towards enhancing cybersecurity preparedness and transparency among U.S. companies.
[1] SEC.gov. (2021). Cybersecurity Disclosure Requirements. [online] Available at: https://www.sec.gov/rules/final/2021/33-11046.pdf
[2] Deloitte. (2021). SEC Cybersecurity Disclosure Requirements: A Primer for Public Companies. [online] Available at: https://www2.deloitte.com/us/en/pages/risk/articles/cybersecurity-disclosure-requirements.html
[3] Wall Street Journal. (2021). SEC's Cybersecurity Disclosure Rules Take Effect. [online] Available at: https://www.wsj.com/articles/secs-cybersecurity-disclosure-rules-take-effect-11632241503
[4] Reuters. (2021). SEC Cybersecurity Disclosure Rules Face Legal Challenges. [online] Available at: https://www.reuters.com/business/legal/sec-cybersecurity-disclosure-rules-face-legal-challenges-2021-09-09/
[5] The Hill. (2021). SEC's new cybersecurity disclosure rules take effect. [online] Available at: https://thehill.com/policy/finance/574427-secs-new-cybersecurity-disclosure-rules-take-effect
- The SEC's new rule mandates public companies to report material cybersecurity incidents within four business days, including ransomware attacks, as part of a broader initiative to foster greater transparency and accountability in the industry.
- In response to the new SEC rules, many companies are Working to mature their cyber risk programs, enabling faster incident response and closer collaboration between the CISO, the C-suite, and corporate directors, in order to better understand the risk calculus of their technology stacks.
- The SEC has begun taking action against companies that provided misleading information about cybersecurity risk or failed to disclose significant issues, such as SolarWinds, which received a notification of potential enforcement in a civil investigation.
- Starting in mid-December, companies will be required to disclose material cybersecurity incidents via Form 8-K, detail their cybersecurity risk management strategy, board members’ cybersecurity expertise or the lack thereof, and third-party cyber risks in their annual 10-K filings, or face substantial penalties up to $35 million per violation.
