How should an organization respond to a cybersecurity incident?

Once a security breach has been identified, companies should respond quickly to secure the impacted systems and fix any vulnerabilities while ensuring there are no other attacks in progress or vulnerabilities that could be exploited. The Federal Trade Commission (FTC) outlines steps companies should take to respond to an incident in their online guide. Once an incident has been deemed material, it must be reported within four days. The front-line IT team, officers, directors, and anyone else aware of a cybersecurity incident should report it prior to the offer and sale of securities. This is to help those trading around the time the incident was discovered avoid an insider trading charge.

What should be included in an SEC cybersecurity incident disclosure?

Management should evaluate the significance associated with cyber-risks and incidents in their disclosures. Cybersecurity disclosures should describe the following: The company’s judgments about materiality What senior management and the board knew and when they knew it How materiality was assessed in light of relevant facts Circumstances of the incident(s), including prior breaches

What are standard practices for keeping accurate cybersecurity disclosure controls and procedures?

Do your organization’s policies, procedures, and controls give senior management the information they need to assess materiality and disclosure implications, including remediation? The SEC recommends that companies annually assess compliance with cybersecurity disclosure controls as part of the SOX 404(a) assessment. Management should consider the following best practices: Assess whether your IT general controls (ITGC) address the risk of failure to make necessary changes to programs or systems Ensure that relevant information about cybersecurity risks is processed and reported up the corporate ladder so senior management can make disclosure decisions and certifications Confirm its IT risk assessment identifies cybersecurity risks and inventories the company’s sensitive data Describe the board’s oversight role with respect to cybersecurity risk management and assess its cyber expertise Annually train the front-line IT team to understand materiality and communicate with the CEO, CFO, and board to avoid insider trading issues and inaccurate disclosures

Article

Are your cybersecurity disclosure controls and procedures up to date?

Q: How can you assess if a cybersecurity incident is material?

Materiality of a cybersecurity incident depends on its impact and the magnitude of compromised information. For example, leaked personal health information (PHI) or personally identifiable information (PII) could be a material event for an organization that relies on protecting their customers’ sensitive information. In the cases mentioned above, the SEC defined materiality broadly and the companies defined it narrowly. Narrow means looking myopically at the impact of a cybersecurity incident Broad means looking at all known facets of a cybersecurity incident including the impact to the registrant’s reputation, customer or vendor relationships, or a registrant’s competitive position Generally, assessing the materiality of a cybersecurity incident is an assessment of the potential impact to the company’s reputation, financial performance, customer and vendor relationships, possibility of litigation, and possibility of regulatory investigation. If the impact is great enough to cause an investor to make a buy or sell decision, then the incident is material.

March 10, 2022 · Updated Aug. 30, 2023 · Authored by Jason Emmons, Weston Nelson

Properly responding to material incidents could protect your organization from receiving charges from the SEC.

The SEC published its final rule meant to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies.

Evaluate incidents carefully

Nonmaterial cyber incidents don’t have to be disclosed to the SEC; however, the number of material cybersecurity incidents is likely higher than organizations report.

What if some of the cybersecurity incidents organizations originally deemed nonmaterial are actually material? How well do organizations evaluate incidents to determine whether they’re material?

SEC enforcement cases

In the past, the SEC rarely enforced actions on cybersecurity incidents. However, three enforcement cases against companies indicate things are changing.

A property title company in California, an educational services company in the United Kingdom, and a software company in South Carolina received enforcement actions for not properly disclosing facts surrounding a material cybersecurity incident.

In each case, front-line IT personnel might not have:

Fully understood how their company defined materiality
Been incentivized to report the vulnerability up the chain of command
Made necessary changes to systems or programs in a timely manner
Describe the incident accurately and completely

The Division of Enforcement within the SEC is signaling a hard line against companies that haven’t designed and implemented cybersecurity disclosure controls that accurately and completely mention all material facts regarding incidents. Registrants should know the new rules give the SEC a new basis for bringing enforcement actions.

How can you assess if a cybersecurity incident is material?

Jason Emmons

Principal

Next up

Increase cash flow with tax methods for repair and maintenance costs

Discover more

Are your cybersecurity disclosure controls and procedures up to date?

Evaluate incidents carefully

SEC enforcement cases

How can you assess if a cybersecurity incident is material?

Jason Emmons

Increase cash flow with tax methods for repair and maintenance costs

Responding to a cybersecurity incident

How should an organization respond to a cybersecurity incident?

Who should be told?

What should be included in an SEC cybersecurity incident disclosure?

What are standard practices for keeping accurate cybersecurity disclosure controls and procedures?

SEC final rules

New item 1.05 of Form 8-K

New regulation s-k item 106

Applicability to foreign private issuers

Effective dates

The role of an internal or external auditor

Have questions? Baker Tilly can help.