New US Securities and Exchange Commission (SEC) cybersecurity disclosure guidelines are coming under fire as potentially causing more harm than good.
The agency posted new rules requiring how and when public companies will report security incidents that have a material impact on their operations. The new SEC rules oblige organisations to disclose a cybersecurity incident within four days of determining that the event had a material impact on the business. The guidelines state breached organisations are also compelled to outline their practices for detecting, assessing, and managing material risks from cybersecurity threats. The breached organisation will need to also reveal prior incidents.
The SEC is holding foreign companies conducting business in the US to the same standard. The rules do allow disclosure to be postponed if the United States Attorney General decides that immediate posting of the incident would put national security or public safety at risk.
SEC opposition
Initial reaction to the new procedures was swift and largely negative, with companies pushing back on the public nature of the disclosures. Critics also said the way material impact is defined will differ by company and industry. Some also questioned whether the disclosures may be overly punitive and lead to even greater damage to the breached companies’ reputations while not actually providing mechanisms to improve corporate cyberdefence against threats.
Two SEC commissioners opposed the new rules around several factors. Describing the disclosure requirements as overly prescriptive, Commissioner Hester Peirce said the details provided might serve as guideposts for threat actors while redirecting resources away from preventing future attacks. She also noted a law enforcement exception which would allow organisations to delay disclosure may be too difficult to obtain in the short four-day window.
SEC Commissioner Mark Uyeda suggested that rules seem to prioritise cybersecurity risks over other threats that may have an even bigger material impact to specific companies. He also observed that introducing a forward-looking disclosure demand in 8-Ks and amendments might be beyond the SEC’s governing scope.
Enforcement of the rules could begin as soon as 15 December, 2023. Organisations will need to include the disclosures in their 10-K filings for fiscal year 2023. With the new rules in place, corporate board of directors and Chief Information Security Officers need to be brought up to speed on the disclosure requirements. It is also essential that they understand all the processes they have in place to guard against incidents that could harm the business significantly from operations, reputation, and financial perspectives.
Click Here For The Original Source.
