The U.S. Securities and Exchange Commission (SEC) has recently implemented new rules regarding enhanced cybersecurity disclosures. These rules, known as the Final Rules, require public companies to promptly disclose any material cybersecurity incidents and provide information about their cybersecurity risk management, strategy, and governance. To help companies prepare for these requirements, here are some practical steps they can take:
1. Review Existing Vendor Contracts: Companies should carefully review their vendor contracts to ensure they address cybersecurity incidents adequately. If necessary, revisions or changes should be made to accommodate the Final Rules. This may include adding provisions that address claims or liabilities arising from the required disclosures.
2. Conduct Vendor Due Diligence: When considering prospective vendors, companies should conduct thorough cybersecurity due diligence investigations. The required disclosures include unauthorized occurrences and related unauthorized occurrences that jeopardize the company’s information systems. This extends to systems owned by third-party vendors. Companies should assess each vendor’s cybersecurity framework, including risk management, strategy, and governance disclosure processes. Additionally, companies should evaluate each vendor’s reporting process and incident response framework.
3. Implement Contractual Commitments for Notification: After a comprehensive due diligence investigation, companies should ensure that contractual commitments and written policies are in place with vendors for prompt notification of cybersecurity incidents. This includes maintaining formal and documented cybersecurity policies and procedures, as well as providing detailed information about incidents.
4. Team Preparedness for Cyber Incidents: Companies should establish coherent and consistent policies and procedures for their board and management to effectively oversee, detect, and monitor cybersecurity risks. The Final Rules emphasize the importance of governance disclosures in enhancing cybersecurity risk management. Companies should provide easily accessible and straightforward information for the board to assess cyber risks and occurrences. It is also crucial to use clear language that is understandable to a reasonable investor.
5. Consult Cyber Insurance Brokers: Companies should have annual briefings with their board on cyber insurance and engage with brokers to discuss cybersecurity risks and liabilities. This will help companies find the right insurance coverage based on their security needs.
By following these steps, companies can better prepare themselves for compliance with the Final Rules and enhance their cybersecurity measures. It is important to seek assistance from chief information security officers, chief information officers, internal teams, and external advisors to strengthen cybersecurity frameworks.
For more information on the Final Rules, refer to the U.S. Securities and Exchange Commission’s Release No. 33-11216 on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. You can also find additional insights in our previous article titled “SEC’s Final Rule on Cybersecurity, Risk Management, Strategy, Governance, and Incident Disclosure.”
