Skip to content

SEC's New Cybersecurity Rules Demand Proactive Strategies

By Calloquy Aug 17, 2023 10:33:51 AM

In an era defined by the rapid digitization of business operations and the increasing frequency of cyber threats, the Securities and Exchange Commission (SEC) has responded with heightened vigilance to safeguard the integrity and security of public companies' data. Recognizing the critical role that cybersecurity plays in maintaining investor confidence and market stability, the SEC has introduced new cybersecurity rules that demand enhanced transparency, accountability, and preparedness from public companies while making third-party compliance with cybersecurity protocols a priority.

One of the key components of the new rules, Form 8-K Item 1.05, has been garnering most analysts’ attention. It mandates that public companies disclose material cybersecurity events in a timely and comprehensive manner. This requirement is rooted in the recognition that cybersecurity incidents will have far-reaching ramifications which can alter a company's financial performance, reputation, and overall market stability. By compelling companies to promptly disclose significant breaches or cyber incidents after they occur, the SEC aims to equip investors with the information necessary to make informed decisions and safeguard their financial interests.

Investors Should (And Will) Also Be Concerned with Regulation S-K Item 106(b)

The SEC's new cybersecurity rules also add Item 106, “Cybersecurity” to Regulation S-K. Item 106(b) requires companies to divulge their cybersecurity preemptive risk management practices in their Annual Report on Form 10-K. Companies must include their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats including:

  • “Whether and how the described cybersecurity processes . . . have been integrated into the registrant’s overall risk management system or processes;
  • Whether the registrant engages assessors, consultants, auditors, or other third parties in connection with any such processes; and
  • Whether the registrant has processes to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider.”

Investors have a vested interest in this regulation as it provides them with insights into a company's ability to mitigate cyber risks and protect sensitive data. The disclosure of past incidents and proactive strategies demonstrates a company's commitment to cybersecurity preparedness, thereby influencing investor confidence and potentially affecting stock prices.

Why Item 106(b) Is Important

Regulation S-K Item 106(b) serves as a critical tool for investors to assess the resilience of companies in the face of evolving cyber threats. With cyber incidents posing financial, operational, and reputational risks, investors rely on this regulation to gauge a company's commitment to risk management and data protection. The transparency afforded by Item 106(b) allows investors to make informed decisions based on a company's cybersecurity posture, enhancing market trust and reinforcing the foundations of sound investment practices.

Additionally, Item 106(b) underscores the importance of having robust and comprehensive cybersecurity policies and procedures in place, including those of any third-party service party provider. Effective policies not only help prevent cyber incidents but also demonstrate a company's proactive approach to safeguarding its digital assets. These policies encompass a wide range of measures, from employee training and access controls to incident response plans and vulnerability assessments. By implementing such policies, companies can not only mitigate the risk of cyber threats but also showcase their commitment to prudent cybersecurity practices, thereby bolstering investor confidence.

Why Ensuring Third Parties Adhere to Cybersecurity Protocols Is Important

Third-party relationships have always been integral to business operations. In the interconnected digital landscape, they can pose liabilities as well. The SEC's regulations recognize this reality and emphasize the significance of extending cybersecurity protocols to third-party entities. Ensuring that vendors, suppliers, and business partners adhere to stringent cybersecurity standards is essential in minimizing vulnerabilities arising from external access points. Failing to monitor and enforce third-party compliance can expose public companies to potential breaches and compromise their overall cybersecurity posture. Calloquy has prepared a checklist for assessing third party court reporters for any company, law firm, legal ops professional, or party engaged in litigation.

The SEC's new cybersecurity rules represent a proactive response to the evolving landscape of cyber threats. By mandating timely and comprehensive disclosures of cybersecurity incidents and emphasizing the importance of transparency, the SEC seeks to empower investors with the information necessary to make informed decisions. Robust cybersecurity policies, along with proactive management of third-party compliance, are pivotal in ensuring a company's resilience against cyber risks and navigating the evolving digital landscape.