When the Security and Exchange Commission’s (SEC) new cyber incident reporting regulation went into effect on December 18, 2023, it immediately drew confusion over what the watchdog meant about a “material” incident.
Questions also surfaced such as how companies are working to comply with the regulation and what new processes and procedures organizations should have to construct in order to comply. It’s worth mentioning that the naysayers saw the SEC's moves as micromanaging.
After letting the hub-bub ebb a little, AuditBoard, a cloud-based audit, risk, compliance and sustainability platform provider, is now offering some answers to decode the disclosure ruling, and has conducted a survey to take the pulse of organizations that must comply with the new rule.
But first, here’s a snapshot of the SEC’s reporting rules:
Enterprise Security Pros and the SEC Cybersecurity Incident Disclosure Rule
In a newly published study, AuditBoard surveyed 314 security professionals working in enterprise environments across multiple industries with revenue exceeding $100 million to determine how their companies are complying or planning to comply with the disclosure regulation.
Here are the report’s key findings:
Creating Processes for SEC Disclosure Rule
Richard Marcus, AuditBoard’s vice president of information security, told MSSP Alert in an email interview that much of the risk of breaches that an organization contends with are “not internal but stem from third-party relationships.”
Here is the text of that Q&A, lightly edited for brevity:
MSSP Alert: The SEC's disclosure rules extend to supply chain companies, perhaps including managed security service providers. In AuditBoard's view, what's the impact of that requirement?
AuditBoard: The current environment of heightened third-party software attacks (or supply chain attacks) and subsequent legislative response is elevating third-party risk management as an organizational priority. Much of the risk that an organization contends with is not internal but stems from third-party relationships. The new regulations will bring a level of transparency around risk management and third-party risk management.
The extension of these requirements down the supply chain also has a cascading effect on reporting requirements for incidents that take place in your vendor ecosystem. A vendor may have an incident that requires disclosure, and if that vendor supports a critical business process, or handles data that is particularly sensitive to your organization you may discover that the incident actually has a material impact on your organization requiring your own disclosure to your shareholders, and so on up and down the supply chain.
MSSP Alert: Some companies may experience cyberattacks on a daily basis if not more frequently. That might be particularly onerous for those companies to report on breaches that meet the materiality criteria. What’s AuditBoard's take on that?
AuditBoard: The key for organizations is to define materiality thresholds that can be used by incident response functions to flag incidents that meet these conditions. They should include guidelines around the types of impacts or the scale of impact that would result in a material impact to the stock prices. For some organizations it may be focused on the loss of intellectual property, reputation damage in the marketplace, or the number of customer records lost or disclosed. Only incidents with impact that meet these materiality definitions will be the ones considered for disclosure to shareholders.
MSSP Alert: The study found that technology is the least mature for compliance with the rules. Why is that?
AuditBoard: Many organizations are looking at the requirements and saying they are not comfortable disclosing today because they have too many gaps and they don't want people to know about that. And so, it may cost them a lot to fill those gaps.
Most organizations lack a technology solution that enables a cross-functional team to review, draft and approve these disclosures in compliance with the regulation. These events are identified in IT or InfoSec, drafted into incident reports that get reviewed by legal, risk, internal audit and/or compliance before being passed to investor relations to start working the disclosure into a filing. Since this is a new requirement, organizations are just now putting together the processes to make compliance achievable and looking for technology to help them implement this quickly.
