According to a study by AuditBoard, eighty-one percent of security leaders say the new U.S. Securities and Exchange Commission (SEC) cybersecurity rules will substantially impact their business.
The report, based on a survey of more than 300 executives and security professionals across North America, finds that despite a majority foreseeing this significant impact, only half (54%) of respondents say they are highly confident in their organization’s ability to comply with the disclosure ruling.
The new SEC rules, which took effect on December 15, 2023, require publicly traded companies to disclose significant cybersecurity threats, and the measures taken to address them, in a timely manner. According to the AuditBoard survey, fully one-third of respondents are still in the early stages of the process to comply with the new ruling, while just 2 percent of survey respondents have yet to start.
Compliance appears to be daunting, with more than two-thirds of respondents (68%) saying the new SEC cybersecurity disclosure overwhelms them. Top-reported challenges as organizations strive for compliance include quantifying cybersecurity incidents (57%) and determining incident materiality (49%).
“Organizations have been planning for the new SEC cybersecurity disclosure rules for some time, but there is still much to be done,” said Richard Marcus, head of information security at AuditBoard. “Several points from the SEC’s guidance suggest the need for an integrated view and collaboration, including: maintaining disclosure controls and procedures, emphasizing the role of boards of directors in overseeing cybersecurity risk management, having a robust incident response program in place, among others.”
https://www.auditboard.com/resources/ebook/decode-the-new-sec-cybersecurity-disclosure-ruling/
