“Today, the importance of data management and technology to business is analogous to the importance of electricity and other forms of power in the past century.” — SEC Commission Statement and Guidance on Public Company Cybersecurity Disclosures

On Feb. 21, 2018, the U.S. Securities and Exchange Commission (SEC) released updated guidance on cybersecurity disclosure for public companies. The agency updated the document’s previous language, which was released in 2011, regarding cyber risks and their impact on investment decisions.

SEC Sets New Standards for Cybersecurity Disclosure

In a press release announcing the update, SEC Chairman Jay Clayton shared his aim to ensure that companies provide “more complete information” to investors about cyber risks and incidents. He also urged companies to “examine their controls and procedures, with not only their securities law disclosure obligations in mind, but also reputational considerations around sales of securities by executives.” Specifically, the SEC guidance cautioned companies to “avoid the appearance of improper trading during the period following an incident and prior to the dissemination of disclosure.” It also pointed to Regulation FD, which covers disclosures to outside entities such as brokers and dealers, investment advisers and others who might reasonably be expected to trade based on privileged information.

However, the main focus of the updated SEC guidance is the need for board directors and company executives to review their controls and procedures to ensure that their cybersecurity disclosure responsibilities are properly discharged. Pointing to the increasing frequency, magnitude and cost of cyber incidents, the document stated that public companies should “take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion, including those companies that are subject to material cybersecurity risks but may not yet have been the target of a cyberattack.”

In addition, the SEC guidance made it clear that if investors are kept in the dark about security incidents, not only should companies expect class action suits, but they’ll have the SEC on their backs as well. In the agency’s words, the SEC “continues to monitor cybersecurity disclosures carefully.”

Impact for Board Directors: Focus on Disclosure

The SEC document noted that the responsibility for clear and expedient disclosure falls squarely on the shoulders of board directors. The board is responsible for ensuring that the organization has appropriate disclosure controls and procedures “to make accurate and timely disclosures of material events.” This helps investors grasp the impact of a cyber incident on the organization and its business, finances, operations and, of course, liability.

The issue of disclosure is further complicated by the need to detect an incident, properly handle the company’s response, recover operations and ensure that all stakeholders are properly notified, from the incident response team all the way to the board. Furthermore, the document stated that the ongoing status of an investigation does not exempt organizations from having to disclose a material security incident. The commission also advised organizations to provide specific information that is meaningful to investors in incident reports.

Impact for Board Directors: Oversight of Cyber Risks

The guidance explained that threat actors have different motives, from financial gain to hacktivism, and that security incidents can also happen due to malicious or negligent insiders. In addition, the consequences of cyberattacks can take many forms, from lost business to reputational damage, strained relationships with suppliers and clients, fines, lawsuits and more.

The SEC emphasized that a breached organization must “disclose the extent of its board of directors’ role in the risk oversight of the company, such as how the board administers its oversight function and the effect this has on the board’s leadership structure.” With this language, it would be extremely difficult for board directors to avoid their responsibility to engage with the C-suite to ensure that cyber risks are managed effectively. In other words, the days of putting your head in the sand are finally over, although most organizations have already phased out this approach.

This can be an opportune time for boards to increase their engagement regarding cyber risks, starting with a review of where the chief information security officer (CISO) sits on the organizational chart and how well cyber risks are integrated into a larger enterprise risk management (ERM) framework. Boards should also review their organization’s three lines of defense and, if need be, get a second opinion from an external source about the effectiveness of the cyber risk management program.

Impact for CISOs: Collaboration and Communication

Like directors are in the crosshairs of the SEC, so too will CISOs be in the crosshairs of board directors. Security leaders need to step up and provide mechanisms to discern the impact and “potential materiality” of cyber risks.

For some CISOs, this will require increased collaboration and cooperation with chief risk officers (CROs) to determine more accurate, timely and objective ways to evaluate and communicate cyber risks. It will also invite increased scrutiny of the organization’s risk management program, both by the C-suite and the board. CISOs should aim to simplify their dashboard, create that elusive single pane of glass and ensure that their communications with board directors are clear and effective.

In other words, when it comes to reporting on cyber risks, CISOs should review the accuracy and timeliness of their reports and ensure that the communications are:

  1. Appropriate and relevant to their audience;

  2. Grounded in a business mindset;

  3. Based on quality data; and

  4. Transparent about weak or unverified data.

The last point is specifically mentioned in the SEC guidance, which noted that any untrue or misleading disclosures need to be corrected quickly at the next possible iteration.

Overall, the updated SEC guidance set the bar a little higher and provided clear reminders — or, when needed, warnings — about the responsibilities of management and the board regarding cybersecurity disclosure.

More from CISO

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…