-Louisa_Svensson-Alamy.jpg?disable=upscale&width=1200&height=630&fit=crop)
September 27, 2024 at 03:21PM
Security leaders must navigate the SEC’s cybersecurity and disclosure rules by understanding 8-K and 10-K filings, disclosing material cybersecurity incidents, and providing annual updates on cybersecurity posture. They need to accurately share cybersecurity updates in a timely manner and lean into transparency to ensure compliance. Additionally, leaders should regularly audit cybersecurity capabilities and engage with legal experts for compliance review.
Based on the meeting notes, here are the clear takeaways for security leaders navigating the SEC’s cybersecurity and disclosure rules:
1. Understanding 8-K and 10-K Filings: Security leaders need to have a deep understanding of 8-K and 10-K filings and implement new processes to simplify compliance with the SEC’s cybersecurity rules.
2. Materiality of Cybersecurity Incidents: Cybersecurity teams must determine whether a cybersecurity incident is “material” – incidents that have a significant impact on financial outcomes, operations, reputation, compliance, and stakeholder relations – and deserving of an 8-K filing. This includes incidents resulting in substantial revenue losses, operational interruption, negative media coverage, legal risk, and customer data loss.
3. Timely Reporting: Companies must file an 8-K within four business days of identifying a material incident. If additional material information is identified, companies would file an amendment to the original 8-K.
4. Details in 10-K Filings: Security teams share details on the current state of the company’s cybersecurity program and strategy, identify oversight of cybersecurity activity, and describe how they evaluate, discover, and mitigate material risks from cybersecurity threats in 10-K filings.
5. Transparency and Compliance: Companies should lean into transparency rather than hiding critical details, and employees need dedicated training on the SEC’s cybersecurity disclosure rules to understand their roles in incident response and annual readouts.
6. Simplifying Compliance: Security leaders should have an overarching cybersecurity framework covering incident response procedures, risk management strategies, and continuous communication and training on cybersecurity policies. They should also engage with legal experts to review compliance posture regularly and ensure dedicated training for employees on the SEC’s cybersecurity disclosure rules.
These takeaways provide a clear outline of what security leaders need to do to ensure compliance with the SEC’s cybersecurity and disclosure rules.