By: Denise Schroeder, CISO & Tom Mershon, Information Security Officer
In the era of digital transformation, cybersecurity isn’t just a tech issue; it’s a strategic imperative. The new SEC cybersecurity regulations, finalized in July and put into effect in December, mark a significant shift in how public companies report and manage cyber risks.
KEY ACTIONS FOR LEADERSHIP
Understand Material Cyber Incident Reporting: The SEC requires timely reporting of material cyber incidents. Boards must be in tune with the management’s process for detecting, escalating, and reporting these incidents. It is crucial to have an incident detection and escalation process in place as well as materiality criteria defined for analysis in order to meet the disclosure requirements.
Coordinate with Third-Party Service Providers:Ensure outsourced service providers are able to meet the new SEC Cyber Incident Disclosure requirements, review service level agreements, and establish incident response protocol.
Build Relationships with Federal Agencies: In certain scenarios, reporting can be delayed for national security reasons. Leadership needs to have a plan in place and have connections with agencies like the FBI and Homeland Security.
Enhance Reporting Practices: Regular and consistent reporting to the board is key. This includes monitoring third-party relationships and understanding how these partners impact your cybersecurity posture. Informing Senior Leadership, and the Board, of emerging cyber and compliance risks creates an opportunity to proactively develop strategic solutions.
Assess Cyber Maturity: Align your cyber risk management with national standards like NIST and ISO. Conduct regular cybersecurity maturity assessments and incident response table-top exercises to gauge your progress and identify areas for improvement.
BEYOND COMPLIANCE: A STRATEGIC OPPORTUNITY
With these new SEC regulations, cybersecurity becomes a strategic dialogue, not just a technical one. It’s about understanding risks, asking the right questions, and ensuring your organization’s cyber resilience aligns with its growth and innovation goals. Directors and executives must be equipped to oversee these risks effectively.
Incident Response Preparedness
As organizations embrace digital transformation, the need for robust incident response programs becomes paramount. It’s not a question of if, but when a cyber incident will occur. Proactive table-top exercises and incident response readiness are essential. Ensure your teams are well-prepared to handle incidents efficiently and minimize potential damage.
Quantitative and Qualitative
When dealing with cyber incidents, it’s crucial to evaluate them from both quantitative and qualitative perspectives. Quantitatively, one needs to measure the financial impact, downtime, and potential data loss. Qualitatively, one should consider the reputational damage, customer trust, the impact to investors, and regulatory implications. This approach provides a comprehensive view of an incident’s true impact and helps in making informed decisions.
Seize the Strategic Opportunity
By investing in table-top exercises, building out incident response protocol, and creating comprehensive incident assessment methodologies, you will not only meet regulatory requirements but will also strengthen your organization’s ability to navigate the digital landscape confidently.
iLLUM Advisors: Your Partner in Cyber Resilience
At iLLUM Advisors, we believe in seizing opportunities where others see challenges. We are committed to guiding organizations through compliance requirements and putting in place an ever-evolving foundation that is one step ahead of the next cyber-incident.
Additional References:
https://www.sec.gov/files/rules/final/2023/33-11216.pdf
https://www.sec.gov/files/33-11216-fact-sheet.pdf
NO LONG-TERM COMMITMENTS – All services and software licensing are offered on a month-to-month basis and clients are billed for services consumed.
If you would benefit from support in developing a strategic roadmap, please schedule a few minutes with an iLLÜM Advisor –Schedule 20 Minutes
