New Cybersecurity Disclosure Requirements to Take Effect Soon
New cybersecurity disclosure requirements mandated by the U.S. Securities and Exchange Commission (SEC) will go into force in the coming days. These requirements will oblige companies to disclose cybersecurity incidents, with some exceptions, within four days of their occurrence.
The disclosure rules consist of two components. The first component is mandatory cybersecurity incident reporting of “material” incidents. Companies will need to disclose incidents using an 8-K form and report them within four business days of the incident. The second component requires companies to disclose their policies for managing cybersecurity risk, including updates on previously reported material cybersecurity incidents.
These requirements entail describing the nature and scope of the incident, the impact on the company’s operations, and any remedial actions taken. Additionally, companies must disclose their cybersecurity risk management, strategy, and governance in annual reports. They are required to outline their policies and procedures for identifying and managing cybersecurity risks, as well as the role of the board of directors in overseeing these risks and management’s role in implementing cybersecurity policies and strategies.
The requirement to report a cybersecurity incident within four days will be effective starting December 18, while the need to disclose cybersecurity management details in annual reports will be effective from December 15.
However, not all cybersecurity incidents will be treated equally. According to guidance issued by the Department of Justice earlier this week, companies can delay reporting incidents where there could be national security risks.
Potential risks that would allow a company to delay reporting include incidents involving techniques for which there is not yet a well-known mitigation, incidents primarily impacting systems containing sensitive U.S. government information, or incidents where the company is conducting remediation for critical infrastructure or critical systems and disclosing the incident would undermine those efforts.
Cybersecurity professionals have mostly welcomed these new requirements. Mike Walters, president and co-founder of risk-based patch management company Action1 Corp., believes that these rules will positively impact cybersecurity enhancement plans in organizations. He stated, “I hope these rules will incentivize greater cybersecurity efforts. Naturally, there will be some initial confusion as companies assess how to navigate the regulations, but everyone will adapt.”
However, Walters does express concern that the disclosures may affect the reputation of companies. He said, “Companies can no longer conceal cybersecurity breaches, which means that any breach can impact their reputation. They may find that most of their incidents aren’t material and may thus choose not to disclose them, driven by the desire to avoid reputational harm. At the same time, if the law requires the disclosure of minor incidents, it will not necessarily solve this problem either, as this approach could overwhelm regulators with incident reports.”
Mike Scott, chief information security officer at data security company Immuta Inc., also acknowledges potential issues with achieving the SEC’s requirements. He believes that companies may face a tough predicament balancing SEC requirements, legal obligations, and protecting themselves and customers against further damage. Scott emphasizes the need for more in-depth training and certifications for security teams.
The new SEC requirements have been a topic of discussion among industry experts. Sean Joyce, global cybersecurity and privacy leader and U.S. cyber, risk, and regulatory leader at PricewaterhouseCoopers LLP, shared insights about these requirements in an interview with theCUBE, SiliconANGLE Media Inc.’s livestreaming studio in August.
Overall, these new cybersecurity disclosure requirements aim to enhance cybersecurity efforts and ensure transparency in reporting incidents. While there may be challenges and concerns along the way, experts believe that organizations will adapt and prioritize cybersecurity measures to comply with these regulations.
Photo: SEC/Flickr