New Cybersecurity Disclosure Requirements to Take Effect Soon
New cybersecurity disclosure requirements mandated by the U.S. Securities and Exchange Commission (SEC) will soon go into force, requiring companies to disclose cybersecurity incidents within four days of their occurrence, with a few exceptions.
The disclosure rules consist of two components. The first component is mandatory reporting of “material” cybersecurity incidents, which must be disclosed via an 8-K form within four business days of the incident. The second component requires companies to disclose their policies for managing cybersecurity risk and provide updates on previously reported incidents in their annual reports.
These requirements include providing details about the nature and scope of the incident, the impact on the company’s operations, and any remedial actions taken. Companies must also disclose their cybersecurity risk management, strategy, and governance in their annual reports. This includes describing their policies and procedures for identifying and managing cybersecurity risks, the role of the board of directors in overseeing these risks, and management’s role in implementing cybersecurity policies and strategies.
The requirement to report a cybersecurity incident within four days will be effective starting December 18, while the need to disclose cybersecurity management details in annual reports will be effective from December 15.
However, not all cybersecurity incidents will be treated the same. According to guidance issued by the Department of Justice earlier this week, companies can delay reporting incidents that pose national security risks.
Potential risks that would allow a company to delay reporting include incidents involving techniques for which there is not yet a well-known mitigation, incidents primarily impacting systems containing sensitive U.S. government information, or incidents where the company is conducting remediation for critical infrastructure or systems and disclosing the incident would undermine those efforts.
The new requirements have been mostly welcomed by cybersecurity professionals. Mike Walters, president and co-founder of risk-based patch management company Action1 Corp., believes that these rules will incentivize greater cybersecurity efforts in organizations. However, he also warns that companies may choose not to disclose minor incidents to avoid reputational harm, which could overwhelm regulators with incident reports.
Mike Scott, chief information security officer at data security company Immuta Inc., acknowledges that achieving the SEC’s requirements is not an easy task and raises concerns about the predicament companies may face in balancing legal requirements, protecting themselves and customers, and complying with the SEC. He emphasizes the need for more in-depth training and certifications for security teams.
The new SEC requirements were discussed by Sean Joyce, global cybersecurity and privacy leader at PricewaterhouseCoopers LLP, in an interview with theCUBE, SiliconANGLE Media Inc.’s livestreaming studio in August.
Overall, these new cybersecurity disclosure requirements aim to enhance cybersecurity efforts and ensure transparency in reporting incidents.