Keeping up with federal regulations is an inevitable part of cybersecurity. While new rules aim to protect business, they also require more work. The U.S. Securities and Exchange Commission (SEC) recently proposed new rules that public companies will need to know. These standardize event reporting and require periodic reporting about cybersecurity policies and procedures. What do they say? How will they affect your business?

According to the SEC, the new changes are intended “to better inform investors about a registrant’s risk management, strategy and governance and to provide timely notification of material cybersecurity incidents.”

Previous guidance had stressed the importance of reporting incidents but did not have a specific timeline or annual reporting requirements. The proposal also mandates disclosures to be presented in Inline eXtensible Business Reporting Language (‘Inline XBRL’). Organizations and financial institutions can submit comments on the proposed changes until May 9, 2022.

Required Reporting Within Four Business Days

According to the SEC proposal, “we are proposing amendments to require current reporting about material cybersecurity incidents. We are also proposing to require periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risks, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise if any, and its oversight of cybersecurity risk.”

Take note: if passed, companies must report within four business days of determining a material event has occurred. However, a determination is different than the date of discovery. The proposal states that reporting cannot be delayed while the company is conducting internal investigations. Plus, the proposal includes non-inclusive examples of material events, such as:

  • An unauthorized incident that has compromised the confidentiality, integrity or availability of an information asset (data, system or network); or violated the registrant’s security policies or procedures
  • An unauthorized incident that caused degradation, interruption, loss of control, damage to or loss of operational technology systems
  • An incident in which an unauthorized party accessed, or a party exceeded authorized access, and altered, or has stolen sensitive business information, personally identifiable information, intellectual property or information that has resulted, or may result, in a loss or liability for the registrant.

The proposal goes on to say that “Additionally, the proposed rules would require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.” By requiring follow-up, the SEC is showing that it requires organizations to ‘clean up’ after an event.

Annual Reporting of Cybersecurity Risk Management

The proposed updates also require annual reporting that provides specific details on preparations and strategies. The three areas of reporting are:

  • Cybersecurity Risk Management & Strategy – the policies and procedures in place to identify and manage cybersecurity risks and threats
  • Governance – the role and responsibility for cybersecurity governance of the board of directors and management levels
  • Board Cybersecurity Expertise – the level of cybersecurity expertise among its board members

While the SEC has provided rules and guidance in this area before, especially in terms of disclosing incidents, the proposed mandates will likely require changes in process if passed. The four-day reporting period in particular will have a meaningful impact on business. Organizations should pay careful attention to the progress of this mandate. Take a look at the internal changes you might need in order to meet these proposed requirements.

More from News

New Survey Shows Burnout May Lead to Attrition

For many organizations and the cybersecurity industry as a whole, improving retention and reducing the skills gap is a top priority. Mimecast’s The State of Ransomware Readiness 2022: Reducing the Personal and Business Cost points to another growing concern — burnout that leads to attrition. Without skilled employees, organizations cannot protect their data and infrastructure from increasing cybersecurity attacks. According to Mimecast’s report, 77% of cybersecurity leaders say the number of cyberattacks against their company has increased or stayed the…

Alleged FBI Database Breach Exposes Agents and InfraGard

Recently the feds suffered a big hack, not once, but twice. First, the FBI-run InfraGard program suffered a breach. InfraGard aims to strengthen partnerships with the private sector to share information about cyber and physical threats. That organization experienced a major breach in early December, according to a KrebsOnSecurity report. Allegedly, the InfraGard database — containing contact information of over 80,000 members — appeared up for sale on a cyber crime forum. Also, the hackers have reportedly been communicating with…

Google Ad Scam Makes Millions Using Fake Adult-Only Sites

An advertising fraud scheme that utilized Google Ads and “pop-unders” on adult websites generated estimated millions of ad impressions on stolen content. The campaign was reported by Malwarebytes on December 20, and the scam raked in an estimated $275,000 per month for the perpetrators. Alerted to the scam, Google shut down the fraudulent activity for violating the company’s policies prohibiting the use of Google Ads on adult sites. A pop-under is a type of advertisement that appears behind an open…

Third-Party Risk Contributes to Healthcare Data Breaches

Since 2009, the number of individuals affected by health data breaches in the U.S. has exceeded the country’s population of 331.9 million. As per federal statistics, this means many people have been victims of more than one incident. Unfortunately, the situation seems to be growing worse. In just the last three years, the volume and frequency of breaches have nearly doubled, from 368 in 2018 to 715 in 2021. And during the first half of 2022, the number of data…