In 2023, the SEC mandated new rules and procedures for public companies with regard to cyber resilience. Many companies are still playing catch-up to ensure proper compliance.
Keep reading to learn about cyber security incident disclosure, what the SEC is doing to ensure compliance, and what your company can do to properly address and comply with these disclosure mandates.
An Overview: SEC Cybersecurity Reporting Guidelines
As cyber threats continue to rise, it’s no surprise that cybersecurity is a major focus of both businesses and regulatory agencies like the SEC.
To enhance transparency, improve investor protection, and ensure that organizations are properly managing cyber risks, the SEC’s cybersecurity reporting guidelines require public companies to disclose material cybersecurity incidents in a timely manner and provide regular updates on their cybersecurity risk management practices.
Critical pieces of the new disclosure requirements include the following:
- Material Incident Reporting. From the date a public company determines that the event is material, they have four business days to report the event.
- Annual Cybersecurity Risk Disclosure. Public companies must include details about their cybersecurity risk management strategies, governance, and policies in annual reports.
- Board Oversight. Public companies must disclose how their boards oversee cybersecurity risks and explain the degree of the board’s cybersecurity expertise.
The Benefits of a Well-Documented Cyber Incident Response Plan
Complying with industry standards and regulations isn’t just about following rules – it’s about fostering a culture of security.
The work involved to comply with the SEC cybersecurity requirements will pay dividends beyond compliance. Documenting a cyber incident response plan will also:
- Mitigate further damage. By solidifying a structured process for managing a security breach, companies will minimize response times to take remediation steps.
- Ensure business continuity. Planning ahead for cyber incidents means you are prepared to face them head-on while minimizing financial losses and maintaining your business reputation. Construct a safety net that also provides business continuity.
- Facilitate communication that builds trust with stakeholders. Identifying defined roles and responsibilities makes communication more effective. By outlining procedures to alert relevant stakeholders about an incident, companies can build trust and strengthen their reputations.
- Secure better cyber insurance coverage. Since more insurance companies now require well-documented cyber incident response plans, a detailed response plan demonstrates a company’s commitment to cybersecurity and improves the chances of obtaining favorable coverage terms.
How Does the SEC Ensure Compliance with Cybersecurity Reporting?
To ensure compliance, the SEC is:
- Monitoring public filings for adherence to the new regulations.
- Investigating companies that fail to disclose material cybersecurity incidents within the required timeframe.
- Imposing penalties and fines for non-compliance or misrepresentation of cybersecurity risks.
In fact, in 2024, the SEC announced charges against four companies for making materially misleading disclosures regarding cybersecurity and disclosure controls and procedures violations.
How to Ensure Compliance with SEC Cybersecurity Reporting Guidelines
Developing and deploying an effective plan to ensure compliance with SEC cybersecurity reporting guidelines will, of course, require time and resources. It might also require trial and effort. And as new cyberthreats continue to emerge, companies must remain vigilant in pursuing compliance.
To facilitate progress toward compliance, companies can take the following five steps:
- Develop an Incident Response Plan. Identify an incident response team and establish clear protocols for identifying, assessing, and reporting cybersecurity incidents.
- Enhance Your Risk Management Strategies. Implement an appropriate cybersecurity framework to proactively address threats and vulnerabilities. Consider designing incident response plans for various scenarios that may occur based on your unique business model.
- Train Your Leadership Team & Employees. Ensure board members and key executives are adequately versed on cybersecurity risks and disclosure responsibilities. Consider conducting periodic simulation drills.
- Conduct Regular Security Audits. Perform periodic assessments to identify potential weaknesses and improve cyber resilience as necessary.
- Engage a Compliance Team. Work with an experienced cybersecurity expert who can ensure timely and accurate disclosures and provide support to properly execute each of the previous steps outlined above.
Learn More About Elevating Your Cybersecurity Posture
These disclosure requirements reflect how critical cyber resilience is for today’s companies. Learn more about how you can proactively address compliance and protect your business from cyber threats — all while strengthening your company’s future reputation.
There is no one-size-fits-all approach to cybersecurity. At PBMares, our Risk Advisory practice is poised to craft tailored and flexible cybersecurity solutions that address your company’s unique needs.
Contact our Risk Advisory Team today.
