The SEC proposed to add new Item 106 to Regulation S-K and updates to Forms 10-Q and 10-K that will require public companies to provide periodic updates about previously disclosed cybersecurity incidents when a material change, addition or update has occurred.
These days cyber-attacks are common across all industries and sectors, however, the finance industry inclusive of fintech seems to be one of the most targeted by cyber-attackers and cyber criminals. In 2021, according to Statista, the finance industry was ranked as the second largest target for cyber-attacks being targeted four times more than healthcare and almost nine times more than government. Although most organizations in the finance industry have built formidable security programs, the inbound threats have also become much more frequent and sophisticated. As cyber-attacks constantly grow in number and sophistication, we see organizations being breached every day. According to J Makas at ThinkAdvisor.com, by 2023 an estimated 33 billion accounts will be affected by cyberattacks targeting the financial sector.
SEC in response to rising threats
The Securities and Exchange Commission (SEC), in response to these rising threats and as a result of concerns voiced surrounding the lack of preparedness across the industry to advanced cyber-threats, has proposed new rules with a focus on standardizing and increasing cyber-reporting across the finance industry and public companies. The new rules proposed on March 9th of 2022 would require public companies to make prescribed cybersecurity disclosures. This proposal is an attempt to protect investors and strengthen their ability to evaluate public companies’ cybersecurity practices and incident reporting. cover IT risk management, cyber incident reporting, and cyber risk disclosure. The proposed rules would make cybersecurity a large part of the overall enterprise risk management
The proposed rules are an expansion on SEC’s previous guidance from 2011 and 2018 and would make material cybersecurity incident reporting, including updates about previously reported incidents as well as ongoing disclosures on companies' governance, risk management, and strategy with respect to cybersecurity risks, including board cybersecurity expertise and board oversight of cybersecurity risks, all mandatory.
In specific, the new rules would add cybersecurity incidents on Form8-K requiring organizations to disclose all cybersecurity incidents and identified risks. The information required on the Form 8-K would cover (a) the timing of cyber-incidents and whether they are resolved or ongoing, (b) required brief details on the nature of the incident, (c) a report on any affected data even if the data was not exfiltrated, d) effects of every cyber incident on the organization’s operations, and e) information on remediation activity. One interesting item of note is that the actual date the cyber-incident began will be required and not just the date it was discovered.
Require companies to disclose
Also, the new rule would require companies to disclose the following in form 10-K:
· Does the company have a cybersecurity risk assessment program and if so, provide a description of such program;
· Does the company engage assessors, consultants, auditors or other third parties in connection with any cybersecurity risk assessment program;
· Does the company have policies and procedures to oversee and identify the cybersecurity risks associated with its use of any third-party service provider (including, but not limited to, those providers that have access to the company's customer and employee data), including whether and how cybersecurity considerations affect the selection and oversight of these providers and contractual and other mechanisms the company uses to mitigate cybersecurity risks related to these providers;
· Does the company undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents;
· Does the company have business continuity, contingency and recovery plans in the event of a cybersecurity incident;
· Have previous cybersecurity incidents have informed changes in its governance, policies, procedures, and technologies;
· How and whether cybersecurity-related risks and incidents have affected or are reasonably likely to affect its results of operations or financial condition and if so, how; and
· Cybersecurity risks are considered a vital part of its business strategy, financial planning, and capital allocation and if so, how.
requires cyber risk management to be identified in the organization's 10-K form
The proposed rules will also require information on the company’s cybersecurity governance, board oversight of the cybersecurity risks, and how cybersecurity risks are managed and assessed to be present in the company’s form 10-K as well as in annual reports. Companies will also be required to identify any members of the board with expertise in cybersecurity including their names and a full description of the nature of their expertise. Besides these requirements, there will also be disclosure requirements to tag any data that at any point was considered to be affected in any way by a cyber-incident. Lastly, foreign private issuers ("FPI") will also have mandatory incident disclosures to make.
These rules proposed by the SEC are meant to provide more visibility to investors as well as the federal government, thereby protecting investors as well as standardizing the level of cybersecurity and IT risk management programs across public companies and the finance industry. It is likely that Congress as well as entities such as the SEC will not stop here and will continue to propose further cybersecurity and IT risk management related regulation.
