Read more about the current Greenbook proposals. ...
This site uses cookies to ensure that we give you the best user experience. Cookies assist in navigation, analyzing traffic and in our marketing efforts as described in our Privacy Policy.
The Securities and Exchange Commission (SEC) recently proposed new amendments to the Securities Exchange Act of 1934 to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance and incident reporting by public companies.
According to the SEC, the proposed amendments aim to improve investors’ knowledge about a registrant’s risk management, strategy and governance, and provide timely notification of cybersecurity incidents through several key requirements, including:
The SEC rule proposal joins what seems to be a laundry list of federal regulatory efforts to formalize cyber incident reporting procedures and processes across several industries. In just the last 12 months, we have reported on numerous executive orders, legislation and proposals, including the three listed below.
The FDIC, the Board of Governors of the Federal Reserve System and the Office of the Comptroller of the Currency (OCC) issued the Computer-Security Incident Notification Final Rule.
FDIC-supervised banking organizations will be required to notify the FDIC no later than 36 hours after the banking organization determines that a computer-security incident that rises to the level of a notification incident has occurred. The final rule takes effect on April 1, 2022, with full compliance extended to May 1, 2022. The FDIC will provide supervised institutions the logistics for the FDIC notification in early 2022.
You can read more about the rule in our recent article. The full copy is viewable at www.fdic.gov/news/board-matters/2021/2021-11-17-notational-fr.pdf.
President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act into law on March 15, 2022. The law requires critical infrastructure entities to report material cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours, and ransomware payments within 24 hours. This is intended to provide the federal government with a better understanding of the nation’s cyber threats and to facilitate a coordinated national response to ransomware attacks.
The full bill is viewable at www.congress.gov/bill/117th-congress/house-bill/5440/text.
The Transportation Security Administration (TSA) Security Directive-Pipeline-2021-01 went into effect on May 28, 2021, shortly after the largest ransomware attack in history hit the Colonial Pipeline. It was the first-ever mandatory cybersecurity ruling for pipelines and liquefied natural gas facilities.
The directive requires owners and operators of critical hazardous liquid and natural gas pipelines to conduct a detailed gap assessment of their cybersecurity programs within 30 calendar days of the directive’s effective date. It also requires them to report information and physical security incidents affecting their IT or operational technology systems to CISA within 12 hours of identification.
The full directive is viewable at www.federalregister.gov/documents/2021/07/20/2021-15306/ratification-of-security-directive.
Information on how to report cyber incidents have been around for years. The Department of Homeland Security (DHS) provides plenty of information on how to report cyber incidents in their Unified Message for Reporting to the Federal Government release, so why are there so many efforts on Capitol Hill to formalize cyber incident reporting?
Historically, the majority of private companies have always had the option to report an incident; however, the recent uptick in large-scale attacks and lack of transparency, combined with the negative press— just google “Colonial Pipeline”—has caused a flurry of reactionary actions from federal agencies and regulatory bodies.
The increased focus on industry-specific cyber incident reporting tends to focus on three primary requirements:
While the regulations and requirements surrounding cyber incidents will continue to grow across all industries and after each high-profile attack, it will be interesting to see how private and public companies react; and more importantly, if they can meet the requirements and if not, how regulators institute the consequences.
Related Links
Related Articles
About Schneider Downs Cybersecurity
The Schneider Downs cybersecurity practice consists of experts offering a comprehensive set of information technology security services, including penetration testing, intrusion prevention/detection review, ransomware security, vulnerability assessments and a robust digital forensics and incident response team. For more information, visit www.schneiderdowns.com/cybersecurity or contact the team at [email protected].
In addition, our Digital Forensics and Incident Response teams are available 24x7x365 at 1-800-993-8937 if you suspect or are experiencing a network incident of any kind.
Read more about the current Greenbook proposals. ...
Learn more about the regional and national supply chain implications of the Baltimore Key Bridge collapse. ...
We’d love to hear from you. Drop us a note, and we’ll respond to you as quickly as possible.
Ask us
[email protected]
p:412.261.3644
f:412.261.4876
[email protected]
p:614.621.4060
f:614.621.4062
[email protected]
p:571.380.9003