June 29, 2022 By Jennifer Gregory 2 min read

Keeping up with federal regulations is an inevitable part of cybersecurity. While new rules aim to protect business, they also require more work. The U.S. Securities and Exchange Commission (SEC) recently proposed new rules that public companies will need to know. These standardize event reporting and require periodic reporting about cybersecurity policies and procedures. What do they say? How will they affect your business?

According to the SEC, the new changes are intended “to better inform investors about a registrant’s risk management, strategy and governance and to provide timely notification of material cybersecurity incidents.”

Previous guidance had stressed the importance of reporting incidents but did not have a specific timeline or annual reporting requirements. The proposal also mandates disclosures to be presented in Inline eXtensible Business Reporting Language (‘Inline XBRL’). Organizations and financial institutions can submit comments on the proposed changes until May 9, 2022.

Required reporting within four business days

According to the SEC proposal, “we are proposing amendments to require current reporting about material cybersecurity incidents. We are also proposing to require periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risks, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise if any, and its oversight of cybersecurity risk.”

Take note: if passed, companies must report within four business days of determining a material event has occurred. However, a determination is different than the date of discovery. The proposal states that reporting cannot be delayed while the company is conducting internal investigations. Plus, the proposal includes non-inclusive examples of material events, such as:

  • An unauthorized incident that has compromised the confidentiality, integrity or availability of an information asset (data, system or network); or violated the registrant’s security policies or procedures
  • An unauthorized incident that caused degradation, interruption, loss of control, damage to or loss of operational technology systems
  • An incident in which an unauthorized party accessed, or a party exceeded authorized access, and altered, or has stolen sensitive business information, personally identifiable information, intellectual property or information that has resulted, or may result, in a loss or liability for the registrant.

The proposal goes on to say that “Additionally, the proposed rules would require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.” By requiring follow-up, the SEC is showing that it requires organizations to ‘clean up’ after an event.

Annual reporting of cybersecurity risk management

The proposed updates also require annual reporting that provides specific details on preparations and strategies. The three areas of reporting are:

  • Cybersecurity risk management & strategy – the policies and procedures in place to identify and manage cybersecurity risks and threats
  • Governance – the role and responsibility for cybersecurity governance of the board of directors and management levels
  • Board cybersecurity expertise – the level of cybersecurity expertise among its board members

While the SEC has provided rules and guidance in this area before, especially in terms of disclosing incidents, the proposed mandates will likely require changes in process if passed. The four-day reporting period in particular will have a meaningful impact on business. Organizations should pay careful attention to the progress of this mandate. Take a look at the internal changes you might need in order to meet these proposed requirements.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today