 security by design part 4 security by design part 4 hemraj thu 10162025 627 security by design part 4 joseph f norton sort by trending latest joseph fnorton trending latest image in my last blog post we explored both the world economic forum global risks report 2023 and the alliance risk barometer 2023 a simple summation of both reports is cyber insecurity cybercrime triggered business interruption is the most feared of all risks cyber connectedness is pervasive cyber business interruptions as a result are pervasive and impactful i had planned in this post to explore the notion that we are all risk managers taught by our parents and or caregivers from the day we are born and to share perspectives on understanding threats and creating a threat catalog however i am going to deviate from my plans to provide you with a special update about the july 26th 2023 release by the security and exchanges commission of their   sec new rules on cybersecurity risk management strategy governance and incident disclosure by public companies  industry media has been ablaze since july 26th with reactions to these new sec cybersecurity rules there has been an immense amount of praise as well as some disappointment expressed about these new sec rules there has also been a significant amount of disinformation published about these rules by quick reactionaries who in my opinion rushed to publish something perhaps too quickly without fully reading and digesting this sec rules release so let s look at the new sec rules because if you are involved in cybersecurity and or risk management  this is a big deal  what is the sec s goal in adopting their new rules on cybersecurity risk management strategy governance and incident disclosure by public companies  the goal of these new rules is to improve public company disclosures concerning cybersecurity and to provide investors with timely and consistent cybersecurity disclosures to allow investors to make informed investment decisions from the sec press release  the securities and exchange commission today adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management strategy and governance the commission also adopted rules requiring foreign private issuers to make comparable disclosures  these new rules now require annual disclosure of a registrant s risk management strategy and governance on form 10k item 106 b  specifically disclosure now requires a description of registrant s processes if any for assessing identifying and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes materiality a shift to  materiality  as a trigger for disclosure will require management cybersecurity and risk management practitioners to better understand how the complex digital business systems of today s companies contribute to business value as well as to systemic risk disclosure of cybersecurity incidents on current reports form 8k item 105  the trigger date for disclosure is changed to four days from when a registrant determines the incident to be material as opposed to discovery disclosure needs to reflect the impacts of a material cybersecurity incident or reasonable likely material impacts within four days from when it is determined to be material guidance is provided as to materiality which is consistent with securities case law the burden to determine materiality is up to the registrant issuer company reporting the incident under existing case law information is considered material if there is a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision or if it would have significantly altered the total mix of information made available clarification that disclosure should describe the material aspects of the nature scope and timing of the incident and the material impact or reasonably likely material impact on the issuer including its financial condition and results of operations clarification that disclosure should include both qualitative factors alongside quantitative factors in assessing materiality to include but not be limited to harm to reputation customer or vendor relations competitiveness possibility of litigation regulatory investigations or action by us or nonus authorities includes recognition that there may be false positives and an incident originally thought to be material may not be includes language that clarifies materiality disclosure to be disclosed without unreasonable delay to avoid issuers deliberately slowing a determination to avoid disclosure recognition that a materiality determination necessitates an informed and deliberative process a new disclosure delay of up to 30 days where an incident poses a substantial risk to national security or public safety as determined by the attorney general systemic risk disclosure that includes material cybersecurity incidents on thirdparty systems the registrant uses and recognition that disclosure may occur by both the service provider and the customer or one but not the other clarified that there would be no impact on information sharing with other companies or government agencies about emerging threats and clarification that a decision to share information does not itself necessarily constitute a determination of materiality clarification that form s3 eligibility will not be impaired by an untimely form 8k filing form 8k delay of up to seven days for those subject to fcc notification rule for customer proprietary network information cpni no disclosure regarding an incident s remediation status or if a remediation is ongoing no disclosure of specific technical information about a planned response to an incident or cybersecurity systems related networks and devices or potential system vulnerabilities at any level of detail no requirement for additional thirdparty incident inquires outside of regular channels of communication and thirdparty service provider contracts or normal disclosure controls and procedures no requirement that the materiality determination be made by the full board a board committee or one or more officers but by normal internal disclosure controls and procedures in demonstration of good faith compliance no new rule on insider trading during the materiality determination period clarification that a data breach or compromise is not in and of itself disclosable but is a factor in determining materiality as are other incident types such as losses of intellectual property reputational damage or business value disclosure about cybersecurity incident in periodic reports form 10q item 106  clarification that an updated incident disclosure should be made in a form 8k amendment not on form 10q annual disclosure of a registrant s risk management strategy and governance on form 10k item 106 b  specifically disclosure now requires a description of registrant s processes if any for assessing identifying and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes the disclosure focus is recast onto processes not policies and procedures to be less prescriptive on operational specifics which could be weaponized by threat actors and a belief that processes are a broader concept which more fully encompasses a registrant s cybersecurity practices expresses the expectation that the disclosure allows investors to ascertain practices such as whether there is a risk assessment program in place with enough detail for investors to understand the registrant s cybersecurity risk profile recognizes that processes also accommodate situations where there are not written policies and procedures provides clarification that processes described should relate to material cybersecurity risks disclosure should include how cybersecurity processes described are integrated with an overall risk management system or process disclosure should include whether registrants engage assessors consultants auditors or other third parties in connection with any such process es includes whether registrant has process to oversee and identify material risks from cybersecurity threats associated with its use of any thirdparty service provider clarification that the burden is on registrants to disclose whatever information is necessary based on their facts and circumstances for a reasonable investor disclosure requires a description of whether any risk from cybersecurity threats including as a result of any previous cybersecurity incidents have materially affect or are reasonable likely to materially affect the registrant including its business strategy results of operations or financial condition and if so how registrants must disclose management s role in assessing and managing the registrant s material risk from cybersecurity threats including disclosure of management positions of committees responsible for assessing and managing such risk and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of expertise disclosure of the processes by which such persons or committees are informed about and monitor the prevention detection and mitigation and remediation of cybersecurity incidents whether such persons or committees report information about these risks to the board of directors or a committee or subcommittee of the board of directors new disclosures of the board s role to describe its oversight of risks for cybersecurity oversight disclosure if any board committee or subcommittee is responsible for cybersecurity oversight requirement to provide description of the processes by which the board or such committee is informed about cybersecurity risks removes disclosure of specific risk types to avoid the suggestion of prescribing cybersecurity policy eliminates the disclosure of cyber risk prevention and detection activities continuity and recovery plans and information about previous incidents that have informed changes in policies and procedures or technologies in a step back from these details removed disclosure of whether and how the board integrates cybersecurity into is business strategy risk management and financial oversight removed the requirement to disclose the frequency of the board or committee s discussion on cybersecurity while acknowledging that this is an observed leading practice removed disclosure whether the registrant has a designated chief information security officer definitions and miscellaneous  cybersecurity incident is defined as an unauthorized occurrence including accidental occurrences not triggered by a threat actor information systems means any resources owned by or used by the registrant compliance dates   annual reports for fiscal years ending on or after december 15 2023 item 105 current report form 8k and 6k foreign private issuers 90 days after these rules are published in the federal register or december 18 2023 whichever is later item 106 smaller reporting companies have an additional 180 days with current reports due 270 days after the date of publication in the federal register or june 15 2024 foreign private issuers and xbrl interactive data format filings have parallel requirements for disclosures of material incidents on form 10f and form 6k inline xbrl filings have a oneyear delay for implementation feedback and comments are welcome as well as any specific cybersecurity or cyber insecurity topic you might want me to comment upon  joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy latest webinars our proven track of record view all image webinar clone of the ciso exchange for a safer digital world image webinar the ciso exchange for a safer digital world image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an adaptive enterprise architecture to succeed doug picirillo 15 best practices in salesforce development many businesses have decided to use salesforce s customer relationship management solution kannan venkataraman 