Are You Ready for New Regulations?

It's almost a day-to-day routine for us in this area to tell you how worrying the growing cybersecurity threats and risks are because of the dire impacts they can have on individuals and organizations worldwide. Factors such as the ongoing digital transformation, the growth of remote work and digital transfers of money, the ability of threat actors to enhance and execute cyberattacks, and the increasing reliance on third parties for information technology services have contributed to the rise in cybersecurity risks. Cyberattacks or cybersecurity incidents can mean high costs for companies and their investors, such as operational disruptions, extortion payments, remediation actions, reputational impacts, legal fines and bankruptcy. The reduction of cybersecurity risks and potential costs for companies and their investors depends on the strategies implemented by the management and boards of directors of these companies. New regulations like the ones discussed in this post will surely lead many organizations to reinforce their cybersecurity plans and practices.

A new regulatory item would require registrants to disclose modifications, additions or updates to previously revealed material cybersecurity incidents. On the other hand, the SEC would require companies to divulge corresponding information when a series of previously undisclosed individual "immaterial incidents" (say, those that didn't have "significant" impacts) become material incidents when aggregated.

As the SEC states, "Staff in the Division of Corporation Finance has observed that most of the registrants that disclosed a cybersecurity incident in 2021 did not describe their cybersecurity risk oversight and related policies and procedures." Companies then would be required to consistently describe in detail their policies and procedures for the prevention, detection, assessment, monitoring and management of cybersecurity risks and threats. Linked to this, on another point, the SEC would require each company to disclose its governance capabilities, including information on oversight by its board and its management's involvement and expertise in implementing the policies and strategies outlined. This would include, for example, reporting on the presence of a chief information security officer, their expertise, and their processes of incident monitoring and reporting to the board of directors.

For investors knowledgeable about cybersecurity issues, being aware of whether there is at least someone with cybersecurity expertise on the board of a registrant in which they may be interested is certainly valuable. With the amendment of a regulatory item, the SEC would precisely require companies to disclose, if any, the cybersecurity expertise of their board members. They would be asked to add details describing the nature of the expertise of whoever possesses it. Among the criteria to be considered in determining whether directors have cybersecurity expertise would be, for instance, their prior experience (e.g., as information security officers, security engineers, security auditors, security policy analysts), certificates or degrees obtained, and knowledge and skills (e.g., in security architecture, security assessment, risk management, incident handling).

On the side of investors and other market participants who interact with investors, the SEC believes that they would benefit from the proposed amendments in several respects. Enhanced disclosure (compared to the current disclosure framework), i.e., a more timely, clear and consistent revelation of cybersecurity incidents, would keep investors alert and adequately informed, as such incidents can affect the performance, reputation and valuation of registrants to varying degrees. In addition, investors would be able to broadly recognize how these companies respond to incidents and what their governance strategies and practices are in the face of cybersecurity risks. This would facilitate their investment decision-making process. Such decisions would also benefit from greater uniformity in disclosures, which would make it less costly for investors to compare companies.

On the side of registrants, those that were not applying these disclosure proposals but in the future will show robust risk management measures and strategies could be better valued by investors. Those companies that were already applying these proposals could also re-evaluate and improve their cybersecurity risk management, strategy and governance and consequently reduce their capital costs. In addition, the disclosure requirement could mean that companies would no longer take advantage of incentives (e.g., reputational) not to report, and there would be a fairer and more transparent comparison between registrants.

Regarding the potential costs of these proposals, the SEC warns that companies could have increased vulnerability. The concern is that cybercriminals could have these reports of cybersecurity incidents and risk management policies and practices at hand to serve as guides for future cyberattacks. Based on these reports, they could define certain companies as targets and take advantage of those with weak risk management strategies or that don't even have boards with members with cybersecurity expertise. Although the SEC has said that (while more details would be required than is currently the case) they would not expect companies to publicly disclose specific technical information about their systems, vulnerabilities and responses to incidents, the aforementioned concern seems to remain. However, the SEC states that "academic research so far has not provided evidence that more detailed cybersecurity risk disclosures would necessarily lead to more attacks."

Moreover, it would be perilous to report in a timely manner when the security issue has not been resolved, as it could aggravate the ongoing attack. Another potential cost would be that "the proposed rules do not require registrants to quantify the impact of the incident." Incident impact reports would be qualitative and inaccurate, leading to uncertainty and inadequate valuations of companies by investors or other market participants. Finally, the SEC speaks of compliance costs, i.e., those that would exist in gathering information and preparing the requested disclosures.

The answer to this question is: improving your cybersecurity posture, both in terms of prevention, management and resilience. Period. While these new regulations lead to nothing more than disclosure of what has happened within your company and what you're doing with your managers and boards of directors regarding cybersecurity, they implicitly call for strength and maturity. To keep your (public or private) company afloat and competitive in its market, our recommendation is that you formulate, improve or redesign your cybersecurity plans, strategies and practices asap. We invite you to reflect with your teams on the following questions.