🏛 What the SEC May Have in Store for Cybersecurity

Originally Featured on GoVanguard Security’s Blog.

Cybersecurity management and execution is quickly shifting from a luxury to a requirement for businesses of all kinds. And a proposed ruleset from the Securities and Exchange Commission (SEC) is yet another driving force behind the change. The SEC oversees financial operations for corporations that trade in public exchanges and enforces laws preventing financial fraud.

For companies that report to the SEC, including foreign private issuers (FPIs), this new ruleset may regulate how they disclose cybersecurity incidents, processes, and expertise. As proposed, these new rules would apply to corporate leadership and boards of directors of any company reporting to the SEC under the Securities Exchange Act.

Some other requirements would include:

In reality this means senior leadership will be held to a higher standard, and more detailed, cybersecurity documentation will be required.

Action on this new ruleset will take time. It would be surprising if it were approved prior to the end of the year. But if enacted, this ruleset may become a double-edged sword for companies reporting to the SEC. While it would enhance cybersecurity, it could also translate to increased costs, following a trend we’ve seen in other industries.

Federal cybersecurity oversight began when the SEC established the Sarbanes-Oxley Act of 2002 (SOX) for the oversight of financial disclosures.

Then in 2003, healthcare saw increased federal cybersecurity oversight with the passage of the HIPAA Security Rule, which created regulations for e-PHI. The same year, CISA was established to evaluate cyber threats facing the U.S.

And more recently, in 2020, the CMMC, overseen by the DoD, was created to oversee cybersecurity standards related to government contracts.

Now it appears the financial industry may be next in line for more oversight. New cybersecurity compliance standards could improve trust and business relations between organizations as well as investors. And immature security postures could damage public opinion, limiting growth, especially in the event of security incidents.

Also, the ruleset could have civil and legal components, which would influence public relations. For example, non-compliance with SOX warrants significant penalties including fines, removal of listing from public trade exchanges, and criminal charges for corporate leadership. The SEC already has rules for reporting cybersecurity incidents, but the proposed ruleset could include more punitive measures if these events stem from improperly managed systems.

Like HIPAA, this SEC ruleset could lead to new compliance standards. On the one hand, this increases the need for cybersecurity training. Luckily, end-user cybersecurity training solutions are relatively affordable and common.

On the other hand, the proposal requires management and leadership involvement for some companies. This has a significant associated monetary cost. Chief Information Security Officers (CISOs) receive C-suite level salaries. Furthermore, if SEC auditing becomes comparable with HIPPA, there would be costs associated with that process as well.

Finally, there are fines to consider. While it’s likely that there will be an implementation grace period, fines likely will follow if companies fail to comply.

Fortunately, if these changes are approved, they won’t be happening overnight. Government wheels turn slowly, and we will likely be waiting for a few months before the new standards are set. A grace period also typically follows implementation.

And while CISOs will certainly be nice to have, they may not be required for all. Typically, standards adhere to scoping laid out by the regulating agency. For example, if a company does not meet certain requirements, like size, revenue, or feasibility of operations, having a CISO may not be required. This is like HIPAA, which is not 100 percent prescriptive and has scoped requirements. Companies also have the option of contracting out CISO services as a cost-saving option.

Finally, it’s safe to assume that current cybersecurity initiatives will not be jettisoned. Government regulations usually stick to well-established standards like NIST CSF and ISO27k series. If organizations are basing their cybersecurity blueprints on these frameworks, the only changes they’ll likely see are new expertise and reporting standards.

While this change could be sweeping, there are steps that companies in the financial sector can take now to get ahead of it:

Even if the proposed ruleset is never adopted, taking these steps will strengthen your organization’s cybersecurity posture. And in a world of increasing cybersecurity threats, enhancing your digital defenses is a true compounding investment.