New Cybersecurity Disclosure Requirements to Take Effect Soon
New cybersecurity disclosure requirements set by the U.S. Securities and Exchange Commission (SEC) will soon be implemented, compelling companies to disclose cybersecurity incidents within four days of their occurrence, with a few exceptions.
The disclosure rules consist of two components. The first component mandates the reporting of “material” cybersecurity incidents through an 8-K form, which must be submitted within four business days of the incident. The second component requires companies to disclose their policies for managing cybersecurity risks, including updates on previously reported incidents.
Under these requirements, companies must provide details about the nature and extent of the incident, its impact on operations, and any remedial actions taken. Additionally, annual reports must include information about cybersecurity risk management, strategy, and governance. This includes describing policies and procedures for identifying and managing cybersecurity risks, outlining the board of directors’ role in overseeing these risks, and explaining management’s role in implementing cybersecurity policies and strategies.
The deadline for reporting a cybersecurity incident within four days is set for December 18th, while the disclosure of cybersecurity management details in annual reports must be done by December 15th.
However, not all cybersecurity incidents will be treated equally. The Department of Justice recently issued guidance stating that companies can delay reporting incidents if there are potential national security risks involved. Situations where there is a suspected involvement of an unknown mitigation technique, incidents primarily affecting systems containing sensitive U.S. government information, or cases where disclosure would undermine ongoing remediation efforts for critical infrastructure or systems are among those that may warrant a delay in reporting.
The new requirements have been mostly welcomed by cybersecurity professionals. Mike Walters, president and co-founder of risk-based patch management company Action1 Corp., believes that these rules will positively impact cybersecurity enhancement plans in organizations. He hopes that they will incentivize greater cybersecurity efforts, although he acknowledges that there may be some initial confusion as companies navigate the regulations.
However, there are concerns that the mandatory disclosures could harm companies’ reputations. Walters warns that companies can no longer hide cybersecurity breaches, which means that any breach could have an impact on their reputation. He suggests that companies may choose not to disclose minor incidents to avoid reputational harm, but this approach could potentially overwhelm regulators with incident reports.
Mike Scott, chief information security officer at data security company Immuta Inc., also raises concerns about the SEC’s requirements. He believes that achieving compliance will not be an easy task and fears that some situations may put companies in a difficult position as they balance SEC requirements, legal obligations, and the need to protect themselves and customers from further damage. Scott suggests that this ruling will highlight the need for more comprehensive training and certifications for security teams.
The new SEC requirements were discussed by Sean Joyce, global cybersecurity and privacy leader at PricewaterhouseCoopers LLP, in an interview with theCUBE, SiliconANGLE Media Inc.’s livestreaming studio. The interview provides insights into what companies need to know about the new requirements.
Overall, these new cybersecurity disclosure requirements aim to enhance cybersecurity efforts and ensure transparency in reporting incidents. While there may be some challenges and concerns along the way, it is expected that organizations will adapt and prioritize cybersecurity in light of these regulations.
Photo: SEC/Flickr