3 Takeaways: New SEC Cyber Risk Disclosure Rules

New rules require a detailed assessment of supply chain and organizational resilience

Yesterday the US Securities and Exchange Commission (SEC) voted 3-2 to issue long-awaited regulations that mandate uniform cyber incident disclosures for public companies.

The SEC’s rulemaking progress has been lengthy and controversial, and cybersecurity experts and business advocates have been eagerly awaiting the release of the final rules after more than a year of public comment and lobbying from business and cyber experts. The SEC made notable changes to the rules in response to public comments. Still, it retained the four-day reporting requirement for public companies once an organization determines that a material cybersecurity incident has occurred.

Determining materiality will require organizations subject to the rule to have full visibility into their own cyber risk posture and that of their suppliers and partners. While the headline is a requirement to report within four days in a new standardized 8-K disclosure, the substance of the rule will require a much greater focus from the C-suite in driving insights and spending to ensure compliance and real-time visibility into diverse threats facing public companies.

The final rules will become effective 30 days following their publication in the Federal Register.

There are three major takeaways we want to highlight from the rules and what we expect in the coming months:

The SEC did listen to public comments and concerns

Earlier versions of the rule would have required regular disclosure of specific Board roles, qualifications, and oversight of cybersecurity matters. The final rule dropped this requirement and imposed greater responsibility on management teams and C-Suite executives to oversee risk management and strategy regarding cyber threats in particular.

The Commission also made notable changes in providing delays to the reporting requirement for cases involving national security and/or public safety and in the scope of information required to be disclosed that cyber experts cautioned could become a roadmap for further exploits by cyber adversaries.

No rule or statute is ever perfect, and we expect these rules will continue to evolve over time as lessons are learned from implementation. The SEC received 150 comments on their proposed rules, and we anticipate business advocacy, shareholder rights groups, and technical experts will continue to help the agency improve the scope of the rules.

Transparency into cyber risk at all levels is vital

As the SEC notes, public companies share varying amounts of detail and data when disclosing cyber events to investors today. In an effort to enhance transparency and build trust with investors, the new SEC requirements will require companies to handle disclosures consistently and transparently using a modified form 8-K. Public companies will also be required to address ongoing cyber risk management in Annual Reports.

For example, the final rule notes that historically, most disclosures “do not describe their cybersecurity risk oversight or any related policies and procedures, even though companies typically address significant risks by developing risk management systems that often include written policies and procedures.”

Once the new requirements take effect, public companies will be required to disclose:

• A description of their cybersecurity risk assessment program.
• Any assessors, consultants, auditors, or third parties that contribute to their cybersecurity risk assessment.
• Policies and procedures to “oversee, identify, and mitigate” third-party cyber risk.
• Activities to prevent, detect, and minimize cybersecurity incidents.
• Business continuity, contingency, and recovery plans for cyber incidents.
• Previous cybersecurity incidents that have informed changes in governance policies, procedures, and technologies.
• How cyber risks have or are “reasonably likely” to affect “operations or financial condition.”
• If cybersecurity risks are considered part of the “business strategy, financial planning, and capital allocation, and if so, how.”

Third-party cyber risk is a material business risk

The SEC’s final rule mentions the term “third-party” 39 times total, and third-party risk was heavily debated. The final rule specifically calls out third-party cyber risk and notes:

Cybersecurity incidents occurring on third-party systems are NOT exempt

The Commission explains that recent cybersecurity trends, including the increasing reliance on third-party service providers, underpinned the need for these new requirements. In fact, recent research by SecurityScorecard and The Cyentia Institute, an independent cybersecurity research firm, is cited directly in the SEC’s final rule: