In July, the Securities and Exchange Commission (SEC) unveiled its finalized cybersecurity disclosure rules, marking a significant milestone in the ongoing effort to enhance transparency and accountability in the realm of cybersecurity.
The final rule centers around the disclosure of “material” cybersecurity incidents, a more refined scope compared to the initial proposal. This decision takes into account compliance costs and the necessity for companies to respond to and rectify incidents. However, the rule does not mandate specific technical disclosures concerning incident response plans or system vulnerabilities. The SEC has weighed the need for disclosure against the risk that divulging technical information might offer threat actors insights for potential future attacks.
The final rules permit companies to delay notification on the grounds of national security, contingent upon a notification from the Department of Justice. The recent issuance of a policy notice by the FBI outlines the process for companies seeking national security delays when disclosing material cyber incidents. Gerding clarified that seeking a delay based on national security concerns does not automatically render a cybersecurity incident material; all relevant facts surrounding the incident must be evaluated.
[/et_pb_text][/et_pb_column] [/et_pb_row] [/et_pb_section]
Leave a Reply