Global Compliance
,
Security and Exchange Commission compliance (SEC)
,
Standards, Regulations & Compliance
How to Navigate New SEC Rules
As cybersecurity breaches have grown in both number and severity, so too has regulatory scrutiny, such as the cybersecurity disclosure rules recently adopted by the SEC.
The new SEC rules, which took effect in late 2023, introduce mandatory cyber-incident reporting requirements for all U.S.-listed companies. Under the new rules, a publicly held company must disclose material cybersecurity incidents in an SEC filing (known as Form 8-K) within four business days after it determines that it has experienced a material cybersecurity incident.
The rising scrutiny puts pressure on organizational leaders and Chief Information Security Officers (CISOs) to improve cybersecurity governance, risk and compliance (GRC). GRC offers a structured way to align IT with business goals while managing risks, providing transparency and achieving compliance with industry and government regulations.
“As new requirements grow, streamlining and standardizing compliance processes across your organization is paramount,” said Sam Junkin, Global GRC Practice and Americas GRC Delivery Leader for Verizon Enterprise Solutions.
This is why documenting the people, processes, and technologies used to respond to cybersecurity incidents will help improve enterprise-wide visibility and enable organizations to proactively prepare for incidents.
What’s a CISO to Do?
The following are actions CISOs can take to help keep companies in cybersecurity compliance while lowering risks:
- Review your organization’s current incident response and reporting process. Beyond having a policy in place, CISOs should conduct regular readiness exercises to help teams uncover gaps in technology and communication that could hinder their timely response to cybersecurity incidents.
- Assess the threats. Strategies and techniques that bad actors use will change, but what remains constant are the risks people face. As the number of human and machine identities has expanded, most security professionals now anticipate an identity-related compromise to occur in their environments over the next year. To manage the risks, CISOs must identify their most critical assets, along with who and what (identities) may access those resources. CISOs must also understand how access is granted, when it happens, and for how long.
- Evaluate existing controls. As part of their ongoing compliance requirements, it’s critical for CISOs to analyze existing security controls and policies against recognized standards, to identify areas where those controls do not adequately mitigate risks. They can implement identity security controls that emphasize Zero Trust and Least Privilege principles, to better monitor and control access to resources.
- Evaluate your company’s internal culture. It’s vital to ensure that employees recognize the importance of cybersecurity. Employees should be reminded about proper email and messaging practices, and they should also complete regular educational training to reduce human mistakes.
- Improve communication skills around risk. CISOs and other executives must also effectively communicate business risks to the board of directors. This means reframing technical metrics and demystifying cybersecurity risks by translating complex jargon into understandable terms, especially in the context of financial and reputational/brand implications. Explore ways to integrate cost-benefit analysis into your cybersecurity framework to help quantify your organization’s highest risks and how to reduce them.
Rising Scrutiny and the Need for Strong Partners
While the new SEC cybersecurity disclosure requirements are designed to enhance transparency in reporting and help investors make informed decisions, the potential for a negative financial impact on companies—in the form of penalties for non-compliance, litigation and other risks—has also increased.
Even before the adoption of the cybersecurity disclosure rules, the SEC and other regulators demonstrated increased focus on cybersecurity and data privacy. Last fall, the SEC filed charges against SolarWinds Corp., and its chief information security officer, alleging incomplete and misleading disclosures about cybersecurity risks and vulnerabilities.
In September 2022, Morgan Stanley agreed to pay $35 million to settle SEC allegations that the financial services firm failed to protect the personally identifiable information of 15 million customers.
And last December, New York’s Department of Financial Services (NYDFS) reached a $1 million settlement with First American Title Insurance Co., for violations of the NYDFS Cybersecurity Regulation in connection with a 2019 data breach.
Potential legal implications underscore the need for organizations to better prepare and protect against cyberattacks.
The new SEC cybersecurity disclosure rules will require a robust plan for compliance. This is where third-party support and validation can help CISOs put in place the right cybersecurity controls that support compliance across a range of regulatory reporting requirements.
The time is ripe for CISOs and top management to work together to proactively prepare for incidents, predict any soft spots, and put into place holistic, enterprise-wide plans to comply with rising regulatory scrutiny, allowing them to respond more quickly and effectively when cyber incidents occur.
In the end, one thing is quite clear: Taking a ‘wait-and-see’ approach is no longer a viable option.
Read on to learn more about the potential risks and resources available.
You can also reach out to Verizon here, or learn more by visiting: www.verizon.com/business/products/security/.