axio - kn

If you see something, say something and get paid by the SEC

What do CISOs and Insurance Risk Managers have in common?

While the SEC’s disclosure rules came at an already stressful time for CISOs, conflicting information and guidance make compliance even more challenging. There are debates around the SEC overstepping in telling companies how to manage risks, disclosure timelines being too short, and requiring the presence of board members with expertise. In this blog, I will walk through the top three SEC cyber rule misconceptions I have seen.

As we step into the new year, 2024 brings forth a heightened need for Chief Information Security Officers (CISOs) to navigate the complex landscape of complying with the SEC Cyber Rules. Accountability for cybersecurity actions has never been more crucial, with the potential consequences of non-compliance ranging from regulatory fines to personal reputational damage and job insecurity. In response to these challenges, we launch Axio360 for SEC Cyber Compliance, a groundbreaking solution designed to be your cybersecurity system of record.

A hospital situated near Kansas City, Missouri, has encountered significant challenges in delivering patient care this week following a cyberattack that severely impacted its systems. Liberty Hospital provided an update on Wednesday, confirming that the disruptions to its computer systems, initiated on Tuesday, persisted. Initially, the hospital had to transfer some patients to alternative healthcare facilities, but authorities asserted that the situation has since stabilized.

Can’t someone just tell me how to calculate materiality?

The SEC’s rules on cybersecurity disclosures have gone into effect, but we still see plenty of questions being raised. One of the top concerns involves bringing qualitative factors of a security event into materiality calculations. The concept of materiality has been around for almost 90 years now but its determination often remains subjective and can vary depending on the business context. The SEC is vague in its definition of materiality because there is no way to objectively inform investors through a magic dollar threshold. The definition has evolved, yet at its core, it emphasizes the need for information that is relevant to informed investment decisions (1).

The SEC cyber rules go live

On December 18^th, 2023 the  Securities and Exchange Commission (SEC) officially rolled out their new cybersecurity disclosure rules. The SEC’s move has sparked pushback from companies and lawmakers who argue that the prescribed timelines are overly restrictive.

Kyivstar, the Ukrainian telecom operator, recently faced a cyberattack disrupting internet and mobile services while President Volodymyr Zelenskyy was in Washington advocating for increased military aid. The company assured on Facebook that subscriber data remained uncompromised, and collaborative efforts with Ukrainian authorities are underway to understand the interference’s circumstances and consequences. Telemetry from NetBlocks revealed the collapse of Kyivstar’s connectivity early Tuesday morning, impacting around half of Ukraine’s mobile subscribers. Market analysts at Telegeography reported 24.3 million mobile subscribers and over 1.1 million home internet subscribers affected.

Navigating the process of requesting delays amid the SEC’s new requirements

We are now less than a week out from the SEC’s new rules going into effect, and public companies have no choice but to be prepared. We know from the SEC’s original statement that companies have 4 days after a material determination to publicly disclose their findings. There was some backlash around this timeline, so the SEC came up with a bit of a compromise. Companies who believe that filing poses a risk to national security or public safety can request a delay. In connection with this exception, the FBI released a public notice with their guidance on how companies can request this delay. Requests can be made by companies or government agencies that might be involved, but whoever is requesting must go through the FBI. The FBI will do their research and confirm the request is legitimate, which will then prompt a referral to the DOJ/Attorney General to make the final decision.

Last week, the Axio services team hosted a webinar roundtable on pragmatic cyber risk management. The presentation focused on what security professionals can do today to be prepared for the  SEC cyber rules as they go into effect on December 15^th, 2023.