The US Securities and Exchange Commission’s aggressive new rules mark a profound regulatory shift in how businesses are now required to manage their cybersecurity risks.

Corporate cybersecurity is becoming a non-negotiable priority. How companies prepare for and defend themselves against cyber intrusions has profound implications for their operations, reputation, and bottom line. Companies have historically underestimated the magnitude of cybersecurity risks, and in the view of the US Security and Exchange Commission (SEC), they have consistently underreported material losses caused by cyber intrusions.

Things have changed. The SEC has just taken steps to ensure that public companies are not just aware of their cybersecurity risks but taking steps to manage them on behalf of their shareholders and promptly report what in practice will be the vast majority of incidents.

THE NEW SEC SECURITY REGULATIONS

The SEC’s new rules are aggressive and intended to enhance accountability and transparency, require covered companies to disclose material cybersecurity incidents within four business days and mandate periodic disclosure of a company’s cybersecurity risk management, strategy, and governance in annual reports. This represents a profound regulatory shift in how businesses are now required to manage their cybersecurity risks and is a testament to the growing recognition of cybersecurity as a core component of adequate corporate compliance.

The newly introduced Form 8-K Item 1.05 mandates companies disclose “material cybersecurity incidents” and “material aspects of the incident’s nature, scope, timing and impact on operations, revenues or stock price. New Regulation S-K Item 106 requires companies to provide detailed disclosures about their cybersecurity risk management, strategy, and governance. In particular, the SEC now requires companies to describe their processes for “assessing, identifying, and managing material risks from cybersecurity threats, as well as whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant.”

To read the full article, go to CSO Online