By: Harry Tajyar, Managing Partner of Investor Relations Partners

The updated SEC disclosure rules for data breach reporting aim to provide shareholders with greater transparency and consistent information for making investment decisions. These rules are designed to hold companies accountable for breach disclosures and overall cybersecurity preparedness, ultimately protecting consumer interests and preventing insider trading.

Key Aspects of the New SEC Rules

The new SEC rules focus on two main areas:

• Timely Disclosure: Companies must disclose information about material cybersecurity incidents within four business days of determining that an incident is material. 
• Strategy, Risk Management, and Governance: Companies must detail their cybersecurity strategies, risk management processes, and governance structures.

Challenges with the New Timeline

The requirement to disclose material incidents within four business days poses a significant challenge. This tight timeline demands efficient operations from security teams to gather and analyze pertinent information swiftly after a cybersecurity incident.

Determining Materiality

Determining what constitutes a material incident has been a topic of concern. The SEC defines materiality as information that a reasonable investor would consider important. This requires company executives to develop robust incident response plans and ensure the reliability of the data used to assess materiality.

Immediate Actions for Companies

Publicly traded companies should:

• Add a materiality trigger to breach notification clauses and incident response (IR) plans.

• Ensure that these plans can be executed without undue delay.

Steps to Compliance

To comply with the new SEC rules, companies should focus on the following areas:

• Understand External Auditor Expectations: Executive management and audit committees must work closely with external auditors, setting clear expectations and building strong communication channels. 
• Appreciate the Reporting Process: Organizations must acknowledge the inevitability of cyber incidents and prepare robust incident response plans. Engaging with law enforcement, such as the FBI or Secret Service, can help define materiality and manage disclosure delays. 
• Review Escalation Frameworks: Companies should review and update their frameworks for analyzing cyber data and train employees to recognize and escalate issues. IR plans should include communication and escalation procedures for engaging legal counsel and law enforcement. 
• Avoid Under-Reporting: The new SEC rules impose substantial penalties for failure to report or under-reporting material incidents. Companies must review their cyber risk management systems, internal controls, and audit procedures to ensure compliance. 
• Leverage Analytics and Automation: Automation tools can enhance threat detection and incident response workflows, saving time and creating efficiency. Behavioral analytics and built-in timelines can help security teams quickly reconstruct events during an incident.

Highlighting Leadership in Investor Relations

Harry Tajyar, Managing Partner of Investor Relations Partners, brings over three decades of experience in investor relations and corporate communications. His extensive background includes guiding numerous companies through complex regulatory landscapes and ensuring compliance with stringent disclosure requirements. Tajyar’s expertise in strategic communication and his deep understanding of SEC regulations have been instrumental in helping organizations navigate the intricacies of the new disclosure rules. His proactive approach and commitment to transparency have earned him a reputation as a trusted advisor in the field.

Looking Forward

Compliance with the new SEC rules will depend on the preplanning efforts of CISOs and collaboration with internal partners and stakeholders. The new rules will test the ability of SOC teams to coordinate with legal, finance, risk, and business counterparts. Investing in robust incident response plans now will help organizations avoid penalties and maintain compliance, while also mitigating the risk of insider trading.

Summary

Companies must act swiftly to align their cybersecurity practices with the new SEC disclosure rules. By focusing on timely disclosure, robust incident response, and leveraging automation, organizations can navigate the complexities of these regulations and protect their stakeholders effectively. With leaders like Harry Tajyar at the helm of investor relations, companies can confidently meet these challenges and enhance their reputation for transparency and accountability.

Published by: Holy Minoza