Confusion around when and how to report cybersecurity breaches continues to plague companies a year after revised US Securities and Exchange Commission (SEC) cybersecurity breach reporting rules came into effect, experts say.
As the agency that regulates and enforces federal US securities laws continues to flex its enforcement muscles against organizations that violate the strict rules, which impose a tight reporting deadline for the disclosure of cybersecurity incidents, CISOs and other senior executives are under increasing pressure to quickly assess and report breaches judged to be material — a challenging determination given their complexity.
Companies get into problems with the SEC when disclosures are either not forthcoming or not timely enough, according to Joe Shusko, a partner with global accountancy firm Baker Tilly’s cybersecurity practice. Consequently, they are finding it necessary to develop new strategies to maintain compliance with the rules, the interpretation and application of which aren’t always clear and vary according to specific situations.
“Determination of materiality isn’t straightforward and shouldn’t be made in isolation — senior security staff should work with their business operations colleagues, legal counsel, external forensics as part of a disclosure committee,” Shusko told CSO.
The SEC’s enforcement isn’t slowing down
The SEC has taken more than 200 enforcement actions since it gained the power to do so in 2015, with a quarter of those involving cybersecurity incidents. A growing list of charges has been filed against companies it deems to have misled investors about incidents that it considers to be material to stakeholders.
In December 2024, filed settled charges against “for making materially misleading statements regarding a cybersecurity attack on Flagstar’s network in late 2021” also known as the Citrix Bleed for $3.55 million. The SEC found that while the company did report the breach, it failed to disclose that sensitive customer data of about 1.5 million people had been exposed.
A few months earlier, the SEC fined four companies $7 million for “misleading cyber disclosures” related to the SolarWinds hack. The quartet — Avaya, Check Point, Mimecast, and Unisys — were faulted for misleading disclosures about the impact of the 2020 software breach on their individual businesses that left investors and other stakeholders in the dark.
The four tech firms each agreed to settle the dispute over its disclosures by paying a fine but without making any admission of wrongdoing. Unisys, which was also charged with security controls violations, agreed to pay a $4-million fine while the other vendors each stumped up around $1 million.
CISOs still grappling with fears over a lack of clarity
Former Uber CSO Joe Sullivan, a security expert convicted for obstruction in the reporting of the 2016 Uber privacy breach, contends that despite the rising number of examples of enforcement, there are still many uncertainties over exactly how companies can achieve compliance.
“There is so much fear out there right now because there is a lack of clarity,” Sullivan told CSO. “The government is regulating through enforcement actions, and we get incomplete information about each case, which leads to rampant speculation.”
Based on its history, the SEC may issue clearer and more detailed guidance on the disclosure rules in the future, Shusko says. However, it is unlikely to make allowances for organizations that fall afoul of the rules even pending future clarification.
The SEC did not immediately respond to inquiries by CSO as to whether any supplementary guidance about its revised reporting rules was in the pipeline. Although the incoming Trump administration has promised to slash business regulations in general, whether cyber incident disclosure rules might be modified — much less when — remains unclear.
Companies should err on the side of transparency
As things stand, CISOs and their colleagues must chart a tricky course in meeting reporting requirements in the event of a cyber security incident or breach, Shusko says. That means anticipating the need to deal with reporting requirements by making compliance preparation part of any incident response plan, Shusko says.
If they must make a cyber incident disclosure, companies should attempt to be compliant and forthcoming while seeking to avoid releasing information that could inadvertently point towards unresolved security shortcomings that future attackers might be able to exploit.
“Organisations should err on the side of transparency,” Shusko says.
Edwards continued: “Get the processes in place, including knowing where to find the form to submit to the SEC and maybe even pre-populate it with as much information as possible. Then, when the unthinkable happens, there’s less chance to panic and make mistakes.”
Recent fines have also laid the groundwork for the SEC to enact enforcement actions against other non-compliant organizations — although the SEC disclosure rules are primarily targeted against publicly traded companies a far greater range of organisations might feel their effects.
Given that clarity around disclosure isn’t always straightforward, there is no real substitute for preparedness, and that makes it essential to practise situations that would require disclosure through tabletops and other exercises, according to Simon Edwards, chief exec of security testing firm SE Labs. “Speaking as someone who is invested heavily in the security of my company, I’d say that the most obvious and valuable thing a CISO can do is roleplay through an incident.”
Company supply chains can also impact breach reporting
“The disclosure rules are targeted towards publicly traded organizations, but that doesn’t necessarily mean non-publicly traded organizations are excluded,” Shusko says. “Public companies will likely expect their business partners to disclose and communicate any cyberattacks that might impact their organizations and as a result their customers. Organisations need to understand their supply chains.”
Baker Tilly’s advice on how companies can mitigate their key IT compliance risks and meet the SEC’s cyber disclosure rules can be found here.
Disclosure rules that are open to interpretation mean that some companies will feel obliged to disclose less-serious security incidents. For example, Shusko says, even though a recent cyberattack against American Water had no material impact the utility, it still disclosed the attack in order to keep its stakeholders informed.
“There is a lack of clarity about where enforcement actions might start,” Sullivan says.
Senior security professionals and their colleagues face a particular challenge in determining if a security incident is material, and therefore something they are obliged to disclose, or something less serious that can be handled in-house.
“[There’s] confusion about what meets the threshold of ‘material’ — companies are all over the place on their disclosures, and the guidance from the SEC has been confusing at best,” Sullivan says.
ADVERTISEMENT
Informasi mengenai KING SLOT, Segera Daftar Bersama king selot terbaik dan terpercaya no satu di Indonesia. Boleh mendaftar melalui sini king slot serta memberikan hasil kembali yang paling tinggi saat sekarang ini hanyalah KING SLOT paling gacor, gilak dan gaco saat sekarang di Indonesia melalui program return tinggi di kingselot serta pg king slot
zoro777 permainan paling top dan garansi imbal balik hasil besar bersama https://zoro777.biz/
zoro88 permainan paling top dan garansi imbal balik hasil besar bersama https://zoro88.asia/
yoktogel88slot permainan paling top dan garansi imbal balik hasil besar bersama https://yoktogel88slot.com/
win888slot permainan paling top dan garansi imbal balik hasil besar bersama https://win888slot.net/
texas888slot permainan paling top dan garansi imbal balik hasil besar bersama https://texas888slot.org/
egp888slot permainan paling top dan garansi imbal balik hasil besar bersama https://egp888slot.org/
kerasakti888slot permainan paling top dan garansi imbal balik hasil besar bersama https://kerasakti888slot.com/
tiger88login permainan paling top dan garansi imbal balik hasil besar bersama https://tiger88login.net/
neng88slot permainan paling top dan garansi imbal balik hasil besar bersama https://neng88slot.com/
maxbet888slot permainan paling top dan garansi imbal balik hasil besar bersama https://maxbet888slot.com/
mantap88slot permainan paling top dan garansi imbal balik hasil besar bersama https://mantap88slot.net/
lumbung888slot permainan paling top dan garansi imbal balik hasil besar bersama https://lumbung888slot.net/
lebah77slot permainan paling top dan garansi imbal balik hasil besar bersama https://lebah77slot.info/
kribo888slot permainan paling top dan garansi imbal balik hasil besar bersama https://kribo888slot.com/
wtobet88 permainan paling top dan garansi imbal balik hasil besar bersama https://wtobet88.asia/
vipwin888 permainan paling top dan garansi imbal balik hasil besar bersama https://vipwin888.asia/
sbctoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://sbctoto88.net/
rajacuan888 permainan paling top dan garansi imbal balik hasil besar bersama https://rajacuan888.asia/
ligatitan88 permainan paling top dan garansi imbal balik hasil besar bersama https://ligatitan88.com/
ligalotus88 permainan paling top dan garansi imbal balik hasil besar bersama https://ligalotus88.com/
ligacuan88 permainan paling top dan garansi imbal balik hasil besar bersama https://ligacuan88.asia/
imbaslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://imbaslot88.co/
balak666slot permainan paling top dan garansi imbal balik hasil besar bersama https://balak666slot.com/
balak666 permainan paling top dan garansi imbal balik hasil besar bersama https://balak666.asia/
aurahoki88 permainan paling top dan garansi imbal balik hasil besar bersama https://aurahoki88.asia/
afctogel88 permainan paling top dan garansi imbal balik hasil besar bersama https://afctogel88.net/
ajr888 permainan paling top dan garansi imbal balik hasil besar bersama https://ajr888.biz/
akunbos88 permainan paling top dan garansi imbal balik hasil besar bersama https://akunbos88.info/
aladin66 permainan paling top dan garansi imbal balik hasil besar bersama https://aladin66.com/
apace88 permainan paling top dan garansi imbal balik hasil besar bersama https://apace88.org/
barbar777 permainan paling top dan garansi imbal balik hasil besar bersama https://barbar777.biz/
barbar88 permainan paling top dan garansi imbal balik hasil besar bersama https://barbar88a.com/
batman888 permainan paling top dan garansi imbal balik hasil besar bersama https://batman888.co/
besar88 permainan paling top dan garansi imbal balik hasil besar bersama https://besar88.asia/
betwin1888 permainan paling top dan garansi imbal balik hasil besar bersama https://betwin1888.com/
bigdewa88 permainan paling top dan garansi imbal balik hasil besar bersama https://bigdewa88.net/
bigslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://bigslot88.biz/
bonaslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://bonaslot88.info/
bos888 permainan paling top dan garansi imbal balik hasil besar bersama https://bos888.asia/
cadas88 permainan paling top dan garansi imbal balik hasil besar bersama https://cadas88.com/
cncbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://cncbet88.org/
colek777 permainan paling top dan garansi imbal balik hasil besar bersama https://colek777.biz/
daun88 permainan paling top dan garansi imbal balik hasil besar bersama https://daun88.biz/
dian88 permainan paling top dan garansi imbal balik hasil besar bersama https://dian88.org/
dragon999 permainan paling top dan garansi imbal balik hasil besar bersama https://dragon999.biz/
dutaslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://dutaslot88.biz/
epicwin888 permainan paling top dan garansi imbal balik hasil besar bersama https://epicwin888.biz/
fokus77 permainan paling top dan garansi imbal balik hasil besar bersama https://fokus77.biz/
fokus88 permainan paling top dan garansi imbal balik hasil besar bersama https://fokus88.biz/
gas1388 permainan paling top dan garansi imbal balik hasil besar bersama https://gas1388.com/
ginting88 permainan paling top dan garansi imbal balik hasil besar bersama https://ginting88.net/
hulk88 permainan paling top dan garansi imbal balik hasil besar bersama https://hulk88.biz/
idnhero88 permainan paling top dan garansi imbal balik hasil besar bersama https://idnhero88.com/
indratogel88 permainan paling top dan garansi imbal balik hasil besar bersama https://indratogel88.biz/
ini1888 permainan paling top dan garansi imbal balik hasil besar bersama https://ini1888.com/
ini88 permainan paling top dan garansi imbal balik hasil besar bersama https://ini88.biz/
joker1888 permainan paling top dan garansi imbal balik hasil besar bersama https://joker1888.biz/
jpslot888 permainan paling top dan garansi imbal balik hasil besar bersama https://jpslot888.biz/
kaisar8888 permainan paling top dan garansi imbal balik hasil besar bersama https://kaisar8888.org/
katak77 permainan paling top dan garansi imbal balik hasil besar bersama https://katak77.biz/
kdslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://kdslot88.com/
levis88 permainan paling top dan garansi imbal balik hasil besar bersama https://levis88.biz/
levistoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://levistoto88.com/
mabar96 permainan paling top dan garansi imbal balik hasil besar bersama https://mabar96.info/
mabosway88 permainan paling top dan garansi imbal balik hasil besar bersama https://mabosway88.com/
mamibet88 permainan paling top dan garansi imbal balik hasil besar bersama https://mamibet88.info/
masterjp88 permainan paling top dan garansi imbal balik hasil besar bersama https://masterjp88.com/
masterslot888 permainan paling top dan garansi imbal balik hasil besar bersama https://masterslot888.biz/
megasloto88 permainan paling top dan garansi imbal balik hasil besar bersama https://megasloto88.com/
melodi88 permainan paling top dan garansi imbal balik hasil besar bersama https://melodi88.asia/
melody888 permainan paling top dan garansi imbal balik hasil besar bersama https://melody888.com/
mewahbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://mewahbet88.biz/
mgs888 permainan paling top dan garansi imbal balik hasil besar bersama https://mgs888.biz/
montana888 permainan paling top dan garansi imbal balik hasil besar bersama https://montana888.net/
mustang777 permainan paling top dan garansi imbal balik hasil besar bersama https://mustang777.biz/
net777 permainan paling top dan garansi imbal balik hasil besar bersama https://net777.asia/
olxslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://olxslot88.biz/
padukabet88 permainan paling top dan garansi imbal balik hasil besar bersama https://padukabet88.net/
pisangbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://pisangbet88.net/
pusaka888 permainan paling top dan garansi imbal balik hasil besar bersama https://pusaka888.biz/
qqalfa88 permainan paling top dan garansi imbal balik hasil besar bersama https://qqalfa88.biz/
qqdewa88 permainan paling top dan garansi imbal balik hasil besar bersama https://qqdewa88.asia/
qqdewa88 permainan paling top dan garansi imbal balik hasil besar bersama https://qqemas88.net/
qqmacan88 permainan paling top dan garansi imbal balik hasil besar bersama https://qqmacan88.net/
qqnusa88 permainan paling top dan garansi imbal balik hasil besar bersama https://qqnusa88.com/
racik88 permainan paling top dan garansi imbal balik hasil besar bersama https://racik88.net/
rajajp888 permainan paling top dan garansi imbal balik hasil besar bersama https://rajajp888.com/
rastoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://rastoto88.com/
rusabet888 permainan paling top dan garansi imbal balik hasil besar bersama https://rusabet888.com/
sabetslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://sabetslot88.net/
sabi88 permainan paling top dan garansi imbal balik hasil besar bersama https://sabi88.info/
saldo666 permainan paling top dan garansi imbal balik hasil besar bersama https://saldo666.com/
saldo88 permainan paling top dan garansi imbal balik hasil besar bersama https://saldo88.net/
sawer88 permainan paling top dan garansi imbal balik hasil besar bersama https://sawer88.info/
sexytogel88 permainan paling top dan garansi imbal balik hasil besar bersama https://sexytogel88.com/
sinarjp88 permainan paling top dan garansi imbal balik hasil besar bersama https://sinarjp88.com/
sizi88 permainan paling top dan garansi imbal balik hasil besar bersama https://sizi88.biz/
sizi999 permainan paling top dan garansi imbal balik hasil besar bersama https://sizi999.asia/
sobatgaming88 permainan paling top dan garansi imbal balik hasil besar bersama https://sobatgaming88.biz/
sobatgaming88slot permainan paling top dan garansi imbal balik hasil besar bersama https://sobatgaming88slot.com/
soda888 permainan paling top dan garansi imbal balik hasil besar bersama https://soda888.biz/
