What May the SEC’s Proposed Cybersecurity Disclosure Rules Mean for Those in Governance Oversight Positions?

Join BDO's Center for Corporate Governance Amy Rojik as she and her colleague Mike Stiglianese, who serves as the Managing Director in BDO Consulting’s Technology Advisory Services Practice, discuss the SEC’s recently proposed rules on cybersecurity risk management, strategy, governance and incident disclosure and the impacts and considerations these rules may have on those charged with governance.

Key Takeaways:

• The SEC proposed cybersecurity disclosure rules are intended to formalize currently expected disclosures around aspects of cybersecurity that are useful to investors
• The board will be required to provide disclosure about the cyber expertise that exists within the organization’s governance structure
• Cybersecurity should be thought of and treated as necessary risk management processes and procedures
• Cyber incident response plans need to be planned in advanced, involve key stakeholders, be well thought out and practiced and be adjusted continually to reflect the changing risk landscape
• Documentation by the organization of the cyber risk management program is critical – including the identification, protection and disposal of data – along with testing of the program
• Process and metrics shared with the board needs to be at the right level – By analogy: The audit committee wants to see the financial statements not the general ledger…

Resources:

• SEC Proposes Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure