June 29, 2022 By Jennifer Gregory 2 min read

Keeping up with federal regulations is an inevitable part of cybersecurity. While new rules aim to protect business, they also require more work. The U.S. Securities and Exchange Commission (SEC) recently proposed new rules that public companies will need to know. These standardize event reporting and require periodic reporting about cybersecurity policies and procedures. What do they say? How will they affect your business?

According to the SEC, the new changes are intended “to better inform investors about a registrant’s risk management, strategy and governance and to provide timely notification of material cybersecurity incidents.”

Previous guidance had stressed the importance of reporting incidents but did not have a specific timeline or annual reporting requirements. The proposal also mandates disclosures to be presented in Inline eXtensible Business Reporting Language (‘Inline XBRL’). Organizations and financial institutions can submit comments on the proposed changes until May 9, 2022.

Required reporting within four business days

According to the SEC proposal, “we are proposing amendments to require current reporting about material cybersecurity incidents. We are also proposing to require periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risks, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise if any, and its oversight of cybersecurity risk.”

Take note: if passed, companies must report within four business days of determining a material event has occurred. However, a determination is different than the date of discovery. The proposal states that reporting cannot be delayed while the company is conducting internal investigations. Plus, the proposal includes non-inclusive examples of material events, such as:

  • An unauthorized incident that has compromised the confidentiality, integrity or availability of an information asset (data, system or network); or violated the registrant’s security policies or procedures
  • An unauthorized incident that caused degradation, interruption, loss of control, damage to or loss of operational technology systems
  • An incident in which an unauthorized party accessed, or a party exceeded authorized access, and altered, or has stolen sensitive business information, personally identifiable information, intellectual property or information that has resulted, or may result, in a loss or liability for the registrant.

The proposal goes on to say that “Additionally, the proposed rules would require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.” By requiring follow-up, the SEC is showing that it requires organizations to ‘clean up’ after an event.

Annual reporting of cybersecurity risk management

The proposed updates also require annual reporting that provides specific details on preparations and strategies. The three areas of reporting are:

  • Cybersecurity risk management & strategy – the policies and procedures in place to identify and manage cybersecurity risks and threats
  • Governance – the role and responsibility for cybersecurity governance of the board of directors and management levels
  • Board cybersecurity expertise – the level of cybersecurity expertise among its board members

While the SEC has provided rules and guidance in this area before, especially in terms of disclosing incidents, the proposed mandates will likely require changes in process if passed. The four-day reporting period in particular will have a meaningful impact on business. Organizations should pay careful attention to the progress of this mandate. Take a look at the internal changes you might need in order to meet these proposed requirements.

More from News

ONCD releases 2024 Report on the Cybersecurity Posture of the U.S.

4 min read - On May 7, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States. This new document is a report card on how well cyber policy followed the guidelines set by the National Cybersecurity Strategy, introduced in March 2023. Here’s what you need to know about the newly released report. Fundamental shifts in cyber roles Over the past year, the U.S. national cybersecurity posture was driven by the 2023 National Cybersecurity…

CISA wants private industry to publicly commit to Secure by Design

4 min read - The tech industry has the power to protect the world from nation-state threat attacks, cyber crime and those wanting to compromise data and manipulate critical infrastructure. But with this power comes great responsibility, which, to be honest, the tech industry has not been that interested in holding. But at the RSA Conference (RSAC) in San Francisco, the cybersecurity and tech communities took steps to exert some power and take responsibility. They took the Secure by Design pledge, a promise to…

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today