What the New SEC Cybersecurity Rules Mean for Tech Companies

On July 26, the US Securities & Exchange Commission (SEC) released a new rule aimed to increase consistency of how and when material cybersecurity information is disclosed to investors and the public. The rule became effective Sept 5, 2023.

With this new rule, publicly traded companies may be required to disclose cybersecurity incidents within as little as four business days. The rule also sets out new requirements for annual reporting to the SEC on cybersecurity preparedness, including:

  • Companies will be asked to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.
  • Companies will also need to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

While these rules apply directly to public companies in the United States, we can expect to see a trickle-down effect in the level of preparedness and urgency that is expected from companies responding to cybersecurity incidents.

Lisa Hartman is Associate General Counsel (Privacy) at SurveyMonkey, and has seven years of experience in public and private high-growth tech companies and international law firms. She has deep experience in GDPR, CCPA, PIPEDA and other privacy regulations.

The first thing Lisa suggests for companies who want to better understand how evolving cybersecurity requirements impact them: plan ahead. “The best-case scenario is being able to create and document a basic plan for what you’ll do in a breach before you ever have one. The National Institute of Standards and Technology (NIST) provides a quick start guide for their cybersecurity framework that’s great for companies getting started in this area. There’s really no need to reinvent the wheel. If you at least have a plan on paper, then you have a starting point for your first incident.” The NIST guide breaks the lifecycle of a security incident into five stages: Identify, Protect, Detect, Respond and Recover. It also provides an overview of activities that should take place within each stage.

Once you’ve defined what needs to take place when a security incident is discovered, you should consider who within your organization will be performing what actions. This can also help you understand any gaps you may have that could require third-party service providers. As Lisa puts it,

“You should not handle something like this on your own. If you’re in this situation, there are a lot of moving pieces. Hopefully you have somebody who knows your product extremely well to help understand the specific impact of the incident, somebody that can keep track of all the organizational tasks, somebody to own communications, etc.” You can also use incident management software for this, as SurveyMonkey and many other large companies do.

With that in mind, be realistic about what you can handle as a company. Security incidents warrant thorough investigation and remediation efforts, highly sensitive customer communications, and more. It’s also not just the SEC you need to worry about when it comes to disclosure—there are many laws and regulations that govern privacy matters and your obligations when responding to them. These regulations vary significantly depending on geography and the nature of the incident. Unless you have in-house experts, Lisa suggests you consider bringing in external help.

“There are plenty of third-party breach forensics providers, external counsel, and even breach coaches that have deep expertise in these situations,” she says. “This is a complex area where missteps can result in litigation and media scrutiny. Even if the SEC rule doesn’t apply to you, you may be subject to requirements to directly notify your customers or data subjects. If you're part of a supply chain, you may need to notify companies you work with as a vendor. You may also have to notify your data protection supervisory authority. All while being careful not to give conflicting information, even as situations develop.”

The increasing expectations around speed of response and transparency for public companies dealing with security breaches will almost certainly set the tone for what the public expects from smaller companies in similar situations. One of the most difficult aspects of this is navigating the pressure to disclose as quickly as possible, often while the investigation is still underway, before having all the details on the incident. When it comes to communicating with limited information, Lisa says, “I don't think there's a bottom-line rule or a silver bullet answer to this. But we’re seeing a shift towards informed regulators, data subjects, and investors expecting more fulsome reporting. People want more details about a breach earlier and more consistently. With regards to the SEC rule specifically, they provide a list of points that need to be included in the report. So, if this applies to you, by knowing what the SEC requires, you can prioritize these pieces in your investigation.”

This required information includes:

  • When the incident was discovered and whether it is ongoing;
  • A brief description of the nature and scope of the incident;
  • Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
  • The effect of the incident on the company's operations; and
  • Whether the company has remediated or is currently remediating the incident.

There’s also significance in what is not on this list—companies are not required to publicly disclose technical details around how the incident is being resolved, or exactly how the system was accessed. Especially if the incident is ongoing, you don’t want to share information that bad actors could use to further exploit a vulnerability.

Data breaches are more costly now than ever, and research shows that cyberattacks are increasing in complexity and frequency. Check Point’s 2023 Cyber Security Report revealed that weekly cyberattacks have increased worldwide by 7% in Q1 2023 compared to the same period last year—and that’s on top of a significant 28% increase from Q3 of 2022 compared to Q3 of 2021. With those breaches increasingly becoming material for public companies, regulations were warranted. Follow these best practices to ensure your company doesn’t run afoul of the new rules.

Featured

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

  • ISC West Announces Keynote Lineup

    ISC West, in collaboration with premier sponsor the Security Industry Association (SIA), announced this year’s dynamic trio of speakers that will headline the Keynote Series at ISC West 2024. Read Now

    • Industry Events
  • Government is Top Targeted Industry for DDoS Attacks in Q4 2023

    The government sector experienced a surge of DDoS attacks in Q4 according to Lumen Technologies (NYSE: LUMN), a global leader in integrated network and cybersecurity solutions. The Lumen Quarterly DDoS & Application Threat Report for Q4 2023 analyzes data from its DDoS mitigation platform and application protection partner, ThreatX, to provide an overview of the DDoS and application-layer attacks that targeted organizations in the last quarter of 2023. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3