CISO Blog

Impact of the New SEC Cybersecurity Regulations on Business Risk and Information Security Practices

New SEC Cybersecurity Regulations: A Must-Read for Public Companies

The SEC has introduced stricter cybersecurity disclosure requirements for public companies. This article breaks down the key impacts, including increased accountability, mandatory reporting, and the need for enhanced cybersecurity practices. Don’t miss out on this essential information. #cybersecurity #SEC #publiccompanies #regulation

Published

2 months ago

October 1, 2024

Ian Keller

Although this article is UC Centric one can learn some valuable lessons from this and also prepare for the inevitable proliferation of these types of regulations in other jurisdictions.

The US Securities and Exchange Commission (SEC) recently introduced new regulations concerning cybersecurity disclosures for public companies. These regulations are designed to provide investors with more comprehensive, timely, and comparable information about cybersecurity risks and incidents, ultimately impacting both business risk and information security practices. This stems from previous incidents where proper disclosure of risk was not done and led investors to believe that their investment was within their risk tolerance.

This regulation has an immediate impact on the overall Business Risk.

Through this regulation there will be Increased Accountability and Scrutiny as the regulations place a heightened emphasis on accountability for cybersecurity risk management. Public companies will face greater scrutiny from investors and regulatory bodies, who will now have access to more detailed and standardised information about their cybersecurity postures.

Then there is the mandatory four-business-day disclosure window for material cybersecurity incidents increases the potential for Reputational Damage and Financial Losses. Companies will have limited time to respond to and remediate incidents before disclosing them publicly, potentially impacting investor confidence and stock prices.

The detailed disclosure requirements, particularly regarding the material impact of cybersecurity incidents, could expose companies to increased Litigation Risks from investors alleging inadequate cybersecurity practices or failure to disclose material information in a timely manner.

The Information Security Practices are not exempt from the impact this regulation has.

The regulations necessitate a more Proactive and Comprehensive approach to Cybersecurity Risk management. Companies will need to establish robust processes for identifying, assessing, and mitigating cybersecurity threats to comply with the annual disclosure requirements regarding their cybersecurity risk management, strategy, and governance.

The four-business-day disclosure deadline for material cybersecurity incidents will force companies to streamline and Enhance their Incident Response Capabilities. They will need to invest in tools and resources that enable rapid detection, containment, and remediation of incidents to minimise their impact and meet the reporting deadline.

The regulations encourage early Collaboration with Law Enforcement and Government Agencies, such as the FBI and CISA, in the event of a cybersecurity incident. This collaboration can provide companies with valuable insights and assistance in responding to and recovering from incidents, potentially mitigating their impact.

Then there is the impact to the Board and Management Involvement: The SEC regulations emphasise the importance of board and management oversight of cybersecurity risks. The rules require disclosures regarding the board’s role in overseeing cybersecurity risks and management’s role in assessing and managing these risks. This focus will likely lead to greater involvement of boards and senior management in shaping cybersecurity strategy and resource allocation.

To surmise, the new SEC regulations on cybersecurity disclosures represent a significant development for public companies. By increasing transparency and accountability, these regulations aim to empower investors with crucial information about cybersecurity risks. However, these regulations also introduce new challenges for companies, requiring them to adopt more proactive cybersecurity risk management practices, enhance their incident response capabilities, and foster closer collaboration with relevant government agencies.

Related Topics:alchemycyberdefence ciso leadership

Up Next

Navigating the Cybersecurity Landscape: A CISO’s Perspective on the Latest Threat Report for the Finance Industry

Don't Miss

Strengthening Information Security by Taming the Technical Debt Dragon

Click to comment

CISO Blog

The Importance of Digital Transformation in Today’s Business World

In today’s rapidly evolving business landscape, digital transformation has become a necessity, not just a trend. It is the integration of digital technologies into every aspect of a business, fundamentally changing how it operates and delivers value to customers. From evolving customer expectations to increased competition and the need for agility, digital transformation is essential for businesses to thrive. By leveraging data as a strategic asset, embracing technological advancements, and shifting to digital business models, organizations can gain a competitive edge, improve efficiency, and enhance customer experiences.

However, successful digital transformation requires more than just technology adoption.

It involves a cultural shift, a skilled workforce, and a focus on cybersecurity and ethical data practices. By embracing digital transformation and addressing these key considerations, businesses can navigate the challenges of the digital age and position themselves for long-term success.

Sources and related content

Published

4 days ago

November 21, 2024

Tanya Keller

Digital transformation is not just a trend but a necessity for businesses seeking to thrive in today’s rapidly evolving landscape. It involves the integration of digital technologies into every aspect of a business, fundamentally changing how it operates and delivers value to customers.

Here’s why digital transformation is crucial:

Evolving Customer Expectations:

Customers are increasingly tech-savvy and demanding personalized experiences across all communication channels. Businesses must be faster in all phases of the customer journey, from interaction to delivery and re-engagement, to meet these expectations.

Increased Competition and Disruption:

Competition is fierce, with new players, especially “insurtech” companies, leveraging technology to disrupt traditional models. These disruptors often offer easy-to-use digital products and target the inefficiencies of established businesses.

The Need for Agility and Resilience:

Businesses must be agile and adaptable to cope with rapidly changing market dynamics and customer preferences. The COVID-19 pandemic highlighted the importance of digital transformation in providing resilience and fallback options for businesses.

Data as a Strategic Asset:

Data is a valuable asset that can drive business decisions, improve customer experiences, and fuel innovation. Digital transformation enables organizations to effectively collect, manage, and analyze data to gain valuable insights.

Technological Advancements:

Rapid technological advancements, such as AI, machine learning, blockchain, and the Internet of Things, offer significant opportunities for businesses to optimize operations, reduce costs, and create new revenue streams.

The Shift to Digital Business Models:

Digital transformation allows businesses to move away from traditional models and embrace new, digitally enabled models. This includes offering digital products and services, utilizing data analytics to personalize offerings, and adopting subscription-based business models.

The Importance of Continuous Improvement:

Digital transformation is an ongoing journey, requiring continuous learning, adaptation, and a focus on optimizing processes and technologies. Businesses must be constantly evolving and improving their digital capabilities to stay ahead of the curve.

The Potential for Enhanced Competitiveness:

Embracing digital transformation can lead to increased efficiency, productivity, and profitability. Businesses that effectively leverage digital technologies can gain a competitive advantage in the market and drive sustainable growth.

In addition to the points mentioned above, it’s important to consider the following:

Cybersecurity: As businesses become increasingly reliant on digital technologies, cybersecurity becomes a critical concern. Strong cybersecurity measures are essential to protect sensitive data and prevent cyberattacks.
Data-Driven Culture: A data-driven culture is essential for successful digital transformation. Employees at all levels should be empowered to use data to make informed decisions. Data literacy and analytics skills should be prioritized in training and development programs.
Ethical Implications: As businesses collect and analyze vast amounts of data, ethical considerations become important. Companies must ensure that data is used responsibly and ethically, and that privacy rights are protected.
Skilled Workforce: Digital transformation requires a skilled workforce with the ability to adapt to new technologies and ways of working. Businesses need to invest in training and development programs to upskill their employees.
Collaboration and Partnerships: Successful digital transformation often involves collaboration with external partners, such as technology providers and consultants. Partnerships can help businesses access the expertise and resources they need to succeed.

By embracing digital transformation and considering these additional factors, businesses can navigate the challenges of the digital age and position themselves for long-term success.

CISO Blog

The Troublemaker’s Take on Liminal Panda

Published

5 days ago

November 20, 2024

Ian Keller

Liminal Panda? More like Liminal Pandaemonium! These cyber-ninjas are sneaking around the telecom world, stealing secrets and causing chaos. They’re like digital pickpockets, slipping into networks and making off with sensitive data.

These Chinese hackers aren’t just stealing your data; they’re stealing your future. They’re compromising critical infrastructure, disrupting services, and undermining national security. It’s like a real-life cyber thriller, but without the cool gadgets and the witty one-liners.

So, what can you do to protect yourself from these digital ninjas? Well, you could start by following some basic security practices. Things like keeping your software up-to-date, using strong passwords, and being wary of phishing attacks. But let’s be real, that’s not enough. You need to be proactive and think like a hacker.

Here are a few tips to help you stay ahead of the curve:

Know your enemy: Understand the tactics, techniques, and procedures (TTPs) of advanced threat actors like Liminal Panda.
Embrace zero-trust security: Don’t trust anyone, not even your own employees.
Invest in advanced security tools: Use tools like endpoint detection and response (EDR) and security information and event management (SIEM) to monitor your network for threats.
Stay informed: Keep up-to-date on the latest cyber threats and vulnerabilities.

Remember, cybersecurity is an ongoing battle. Don’t let the Liminal Pandas win.

Download the report here

CISO Blog

The Dirty Little Secrets of Cybersecurity

We’ve all heard the horror stories: massive data breaches, ransomware attacks, and identity theft. But what are the real reasons behind these cyber catastrophes? It’s not always about some shadowy hacker genius; often, it’s about simple mistakes and oversights.

Published

7 days ago

November 18, 2024

Ian Keller

The Dirty Little Secrets of Cybersecurity

The human element is a significant factor in many cyberattacks.. From clicking on malicious links to falling victim to social engineering tactics, people can inadvertently open the door to cybercriminals.

Here are the mistakes being made and funnily enough the Top 3 (According to me) has to do with People…