We suggest you gather your team, as noted below, to ensure you have discussed or refined your process for these new compliance requirements.\u00a0 As food for thought, we have gathered the below steps to initiate further discussions internally:<\/p>\n

Rally your team for cyber filings: Gather your existing cross-functional team, consisting of CISO\/security teams, finance, legal, and audit professionals. This team (hopefully already assembled for current compliance) will play a crucial role in assessing, identifying, and managing cybersecurity risks, ensuring compliance with the new rules.\u00a0 Importantly, this team will have the critical role of determining what a material cybersecurity incident is that would require disclosure.
\n\tGain resolution on what is “material”: Work closely with your team to clearly define what constitutes a “material” cybersecurity incident for your organization. This can be challenging, as the idea of materiality is not always clear cut, so consider a process to rely on after any considerable cyber incident in order to make a determination. This will ensure the appropriate level of disclosure required under the new rules.
\n\tMove toward a cyber risk score and description: We are now asked in S-K Item(s) 106 (b) to describe \u201cpolicies and procedures to identify and manage cybersecurity risks.\u201d Implement a cyber risk quantification process to assess and manage cybersecurity risks effectively. This process should provide a clear risk scoring mechanism and a comprehensive description of the organization’s cyber risk management strategies.
\n\tStart board reporting on cyber risk now: Initiate regular reporting on cyber risk to the board by making it a permanent agenda item. This will ensure that the board is actively involved in overseeing cybersecurity risks and can provide valuable insights for annual filings.
\n\tCapture board expertise for next filing: Have a security leader engage the board to capture their expertise in the preparation of the next annual filing. The SEC tells us we must share \u201cmanagement\u2019s role and expertise in assessing and managing cybersecurity risk.\u201d<\/p>\n

Compliance with the SEC’s new cyber rules is crucial for organizations to protect themselves and their stakeholders from cybersecurity- and compliance-related risks. By considering these five steps, organizations can begin to navigate the regulatory landscape effectively and ensure they meet the requirements for disclosure and risk management. Naturally, this blog is not meant to be legal advice, however, we hope you find it useful in considering your compliance moving forward.<\/p>\n