What the New SEC Cybersecurity Rules Mean for Tech Companies

On July 26, the US Securities & Exchange Commission (SEC) released a new rule aimed to increase consistency of how and when material cybersecurity information is disclosed to investors and the public. The rule became effective Sept 5, 2023.

With this new rule, publicly traded companies may be required to disclose cybersecurity incidents within as little as four business days. The rule also sets out new requirements for annual reporting to the SEC on cybersecurity preparedness, including:

  • Companies will be asked to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.
  • Companies will also need to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

While these rules apply directly to public companies in the United States, we can expect to see a trickle-down effect in the level of preparedness and urgency that is expected from companies responding to cybersecurity incidents.

Lisa Hartman is Associate General Counsel (Privacy) at SurveyMonkey, and has seven years of experience in public and private high-growth tech companies and international law firms. She has deep experience in GDPR, CCPA, PIPEDA and other privacy regulations.

The first thing Lisa suggests for companies who want to better understand how evolving cybersecurity requirements impact them: plan ahead. “The best-case scenario is being able to create and document a basic plan for what you’ll do in a breach before you ever have one. The National Institute of Standards and Technology (NIST) provides a quick start guide for their cybersecurity framework that’s great for companies getting started in this area. There’s really no need to reinvent the wheel. If you at least have a plan on paper, then you have a starting point for your first incident.” The NIST guide breaks the lifecycle of a security incident into five stages: Identify, Protect, Detect, Respond and Recover. It also provides an overview of activities that should take place within each stage.

Once you’ve defined what needs to take place when a security incident is discovered, you should consider who within your organization will be performing what actions. This can also help you understand any gaps you may have that could require third-party service providers. As Lisa puts it,

“You should not handle something like this on your own. If you’re in this situation, there are a lot of moving pieces. Hopefully you have somebody who knows your product extremely well to help understand the specific impact of the incident, somebody that can keep track of all the organizational tasks, somebody to own communications, etc.” You can also use incident management software for this, as SurveyMonkey and many other large companies do.

With that in mind, be realistic about what you can handle as a company. Security incidents warrant thorough investigation and remediation efforts, highly sensitive customer communications, and more. It’s also not just the SEC you need to worry about when it comes to disclosure—there are many laws and regulations that govern privacy matters and your obligations when responding to them. These regulations vary significantly depending on geography and the nature of the incident. Unless you have in-house experts, Lisa suggests you consider bringing in external help.

“There are plenty of third-party breach forensics providers, external counsel, and even breach coaches that have deep expertise in these situations,” she says. “This is a complex area where missteps can result in litigation and media scrutiny. Even if the SEC rule doesn’t apply to you, you may be subject to requirements to directly notify your customers or data subjects. If you're part of a supply chain, you may need to notify companies you work with as a vendor. You may also have to notify your data protection supervisory authority. All while being careful not to give conflicting information, even as situations develop.”

The increasing expectations around speed of response and transparency for public companies dealing with security breaches will almost certainly set the tone for what the public expects from smaller companies in similar situations. One of the most difficult aspects of this is navigating the pressure to disclose as quickly as possible, often while the investigation is still underway, before having all the details on the incident. When it comes to communicating with limited information, Lisa says, “I don't think there's a bottom-line rule or a silver bullet answer to this. But we’re seeing a shift towards informed regulators, data subjects, and investors expecting more fulsome reporting. People want more details about a breach earlier and more consistently. With regards to the SEC rule specifically, they provide a list of points that need to be included in the report. So, if this applies to you, by knowing what the SEC requires, you can prioritize these pieces in your investigation.”

This required information includes:

  • When the incident was discovered and whether it is ongoing;
  • A brief description of the nature and scope of the incident;
  • Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
  • The effect of the incident on the company's operations; and
  • Whether the company has remediated or is currently remediating the incident.

There’s also significance in what is not on this list—companies are not required to publicly disclose technical details around how the incident is being resolved, or exactly how the system was accessed. Especially if the incident is ongoing, you don’t want to share information that bad actors could use to further exploit a vulnerability.

Data breaches are more costly now than ever, and research shows that cyberattacks are increasing in complexity and frequency. Check Point’s 2023 Cyber Security Report revealed that weekly cyberattacks have increased worldwide by 7% in Q1 2023 compared to the same period last year—and that’s on top of a significant 28% increase from Q3 of 2022 compared to Q3 of 2021. With those breaches increasingly becoming material for public companies, regulations were warranted. Follow these best practices to ensure your company doesn’t run afoul of the new rules.

Featured

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3