{"id":20185,"date":"2023-12-26T14:01:38","date_gmt":"2023-12-26T21:01:38","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=20185"},"modified":"2024-04-10T15:16:09","modified_gmt":"2024-04-10T22:16:09","slug":"secs-new-cybersecurity-disclosure-rules-what-does-it-mean-for-you","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/secs-new-cybersecurity-disclosure-rules-what-does-it-mean-for-you\/","title":{"rendered":"SEC\u2019s New Cybersecurity Disclosure Rules: What Does it Mean for You?"},"content":{"rendered":"\t\t
In the last week of July 2023, the United States Securities and Exchange Commission (SEC) announced its <\/span>adoption of new guidelines<\/span><\/a> relating to the disclosure of cybersecurity incidents. This comes at a time when cyber attack incidents and consequent financial losses are at an <\/span>all-time high<\/span><\/a>, calling for increased awareness at all levels.<\/span><\/p> The new guidelines require companies, both public and private, to disclose information regarding security incidents including details of their risk management, strategy, and governance measures. The update aspires to enhance and standardize disclosures by organizations that are subject to the reporting requirements of the Securities Exchange Act of 1934. With this, the onus is now on companies to provide their investors with relevant, accurate and timely information, enabling them to make informed decisions.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t The <\/span>SEC<\/span><\/a> is an independent agency of the US federal government, created post the 1929 Wall Street crash with the intention to enforce the law against market manipulation.\u00a0 Its operations are five-fold:<\/span><\/p> Cyber attacks, network intrusions, supply chain attacks, and ransomware incidents have become commonplace. The financial sector, industrial sector, and federal governments are among the top categories that have borne the brunt of such attacks. According to <\/span>research<\/span><\/a>, the global average cost of a data breach reached $4.45 million in 2023 \u2013 an all-time high based on a 15% increase over the last three years.\u00a0<\/span><\/p> Consequently, cybersecurity governing bodies worldwide have become extremely vigilant in the enforcement of cyber policies. Keeping in line, the US government enforced the <\/span>Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)<\/span><\/a> in March 2022, regulating organizations to report cyber incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA). The intention behind these efforts is to spot attack patterns, render assistance to victims and warn potential targets.\u00a0<\/span><\/p> The recently adopted rules by the SEC\u00a0 aim to enhance transparency and accountability by requiring companies to disclose both specific incidents and their broader cybersecurity strategies, emphasizing the importance of these issues to investors. It also underscores the increasing importance of cybersecurity considerations in the broader landscape of corporate governance and reporting.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t The latest rules put the responsibility on organizations to keep their investors informed of any relevant breaches or data loss issues, in specified formats.\u00a0<\/span><\/p> How to comply with the new rules?<\/b><\/p> Failing to abide by the SEC\u2019s rules can result in legal complications and fines. Adhering to the new rules is a must in order to retain existing investors and attract new ones.\u00a0<\/span>In 2023<\/span><\/a> the SEC filed 784 enforcement actions, ordered for $5 billion financial remedies, and distributed $1 billion to harmed investors. The rulings spanned across the security industry, covering\u00a0 billion-dollar frauds and crypto investor threats involving asset securities and cybersecurity. Violators from public companies to social media influencers were charged with protection for investors and whistleblowers. <\/span><\/p> Some instances where the SEC\u2019s rules were enforced:<\/span><\/i><\/p> Complying with the new SEC rules might require organizations to change the way they have been practicing cybersecurity so far. Companies need to up their game in identifying, assessing, and managing security risks that could affect investors. Here are some influential factors that might affect future organizational practices:<\/span><\/p> It is also important to note that the rules adopted by the SEC are not exclusive to US companies; they also apply to foreign private issuers. This means that companies based outside the US that are listed on US exchanges are subject to SEC reporting requirements and must comply with these disclosure rules as well.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t The new SEC rules aim to strengthen the position of investors, pushing them to be completely \u201caware\u201d of what they are investing in. The compulsory rule to disclose cybersecurity incidents by companies means that investors will now be aware of any significant breach or incident that could impact their strategic decisions. The annual disclosure of cybersecurity information can provide investors with insights into how a company is addressing and managing cybersecurity risks.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\tWhat is the SEC?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Why is this a Critical Development?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
What does this mean for your Organization? <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Consequences of Failure to Comply with the New SEC Rule<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
What can Organizations Expect?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
What does this mean for Investors?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t