What the New SEC Cybersecurity Rules Mean for Tech Companies
On July 26, the US Securities & Exchange Commission (SEC) released a new rule aimed to increase consistency of how and when material cybersecurity information is disclosed to investors and the public. The rule became effective Sept 5, 2023.
With this new rule, publicly traded companies may be required to disclose cybersecurity incidents within as little as four business days. The rule also sets out new requirements for annual reporting to the SEC on cybersecurity preparedness, including:
- Companies will be asked to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.
- Companies will also need to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.
While these rules apply directly to public companies in the United States, we can expect to see a trickle-down effect in the level of preparedness and urgency that is expected from companies responding to cybersecurity incidents.
Lisa Hartman is Associate General Counsel (Privacy) at SurveyMonkey, and has seven years of experience in public and private high-growth tech companies and international law firms. She has deep experience in GDPR, CCPA, PIPEDA and other privacy regulations.
The first thing Lisa suggests for companies who want to better understand how evolving cybersecurity requirements impact them: plan ahead. “The best-case scenario is being able to create and document a basic plan for what you’ll do in a breach before you ever have one. The National Institute of Standards and Technology (NIST) provides a quick start guide for their cybersecurity framework that’s great for companies getting started in this area. There’s really no need to reinvent the wheel. If you at least have a plan on paper, then you have a starting point for your first incident.” The NIST guide breaks the lifecycle of a security incident into five stages: Identify, Protect, Detect, Respond and Recover. It also provides an overview of activities that should take place within each stage.
Once you’ve defined what needs to take place when a security incident is discovered, you should consider who within your organization will be performing what actions. This can also help you understand any gaps you may have that could require third-party service providers. As Lisa puts it,
“You should not handle something like this on your own. If you’re in this situation, there are a lot of moving pieces. Hopefully you have somebody who knows your product extremely well to help understand the specific impact of the incident, somebody that can keep track of all the organizational tasks, somebody to own communications, etc.” You can also use incident management software for this, as SurveyMonkey and many other large companies do.
