The New SEC Regulations with Jack Powell

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  We're joined today by Jacqueline (AKA “Jack”) Powell, CISO at Allianz Life and former Deputy CISO at Hanes.  She has also consulted, and has worked at Chevron, General Dynamics, and SACI.  Jack has an illustrious career!  Jack is here today talking with Allan about the new SEC regulations about cybersecurity.  For our listeners, the final version of the SEC ruling came out in late July, and publicly traded companies in America have 5 months to comply.  Mid-December is when the switch gets thrown…

Topics covered in this show:

1. The new ruling and tell me its highlights
   1. Disclosure
   2. Risk Management
   3. Board expertise
2. What are the implications of the disclosure rules?  What are the challenges businesses face?  What tools can be leveraged?
3. It seems that “materiality” is the key term upon which all of this pivots. That term has definition and precedence in financial circles, but how is a cybersecurity professional to interpret it?
4. What are the implications of the Risk Management rule? If you work with a cybersecurity framework like NIST CSF, for example, you’ve already got at least the basics in place?
5. And now we get to Board Expertise… CISOs are all anticipating getting board roles overnight, but it’s not that easy. NACD in conjunction with CISA put some material together.
6. How should CISOS prepare themselves to be ready for a possible board role?