Keeping up with federal regulations is an inevitable part of cybersecurity. While new rules aim to protect business, they also require more work. The U.S. Securities and Exchange Commission (SEC) recently proposed new rules that public companies will need to know. These standardize event reporting and require periodic reporting about cybersecurity policies and procedures. What do they say? How will they affect your business?
According to the SEC, the new changes are intended “to better inform investors about a registrant’s risk management, strategy and governance and to provide timely notification of material cybersecurity incidents.”
Previous guidance had stressed the importance of reporting incidents but did not have a specific timeline or annual reporting requirements. The proposal also mandates disclosures to be presented in Inline eXtensible Business Reporting Language (‘Inline XBRL’). Organizations and financial institutions can submit comments on the proposed changes until May 9, 2022.
Required reporting within four business days
According to the SEC proposal, “we are proposing amendments to require current reporting about material cybersecurity incidents. We are also proposing to require periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risks, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise if any, and its oversight of cybersecurity risk.”
Take note: if passed, companies must report within four business days of determining a material event has occurred. However, a determination is different than the date of discovery. The proposal states that reporting cannot be delayed while the company is conducting internal investigations. Plus, the proposal includes non-inclusive examples of material events, such as:
- An unauthorized incident that has compromised the confidentiality, integrity or availability of an information asset (data, system or network); or violated the registrant’s security policies or procedures
- An unauthorized incident that caused degradation, interruption, loss of control, damage to or loss of operational technology systems
- An incident in which an unauthorized party accessed, or a party exceeded authorized access, and altered, or has stolen sensitive business information, personally identifiable information, intellectual property or information that has resulted, or may result, in a loss or liability for the registrant.
The proposal goes on to say that “Additionally, the proposed rules would require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports.” By requiring follow-up, the SEC is showing that it requires organizations to ‘clean up’ after an event.
Annual reporting of cybersecurity risk management
The proposed updates also require annual reporting that provides specific details on preparations and strategies. The three areas of reporting are:
- Cybersecurity risk management & strategy – the policies and procedures in place to identify and manage cybersecurity risks and threats
- Governance – the role and responsibility for cybersecurity governance of the board of directors and management levels
- Board cybersecurity expertise – the level of cybersecurity expertise among its board members
While the SEC has provided rules and guidance in this area before, especially in terms of disclosing incidents, the proposed mandates will likely require changes in process if passed. The four-day reporting period in particular will have a meaningful impact on business. Organizations should pay careful attention to the progress of this mandate. Take a look at the internal changes you might need in order to meet these proposed requirements.