SEC Releases New Proposal to Standardize and Enhance Cyber Reporting

The Securities and Exchange Commission (SEC) recently proposed new amendments to the Securities Exchange Act of 1934 to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance and incident reporting by public companies.

According to the SEC, the proposed amendments aim to improve investors’ knowledge about a registrant’s risk management, strategy and governance, and provide timely notification of cybersecurity incidents through several key requirements, including:

• Filing or furnishing a report within four business days after occurrence of the event unless otherwise specified. If the event occurs on a Saturday, Sunday or holiday on which the Commission is not open for business, then the four-business day period shall begin to run on, and include, the first business day thereafter. If the event occurs on a Saturday, Sunday or holiday on which the Commission is not open for business, then the four-business day period shall begin to run on, and include, the first business day thereafter.
• Current reporting about material cybersecurity incidents and periodic reporting to provide updates about previously reported cybersecurity incidents.
• Periodic reporting about a registrant’s policies and procedures to identify and manage cybersecurity risks; the registrant’s board of directors' oversight of cybersecurity risk; and management’s role and expertise in assessing and managing cybersecurity risk and implementing cybersecurity policies and procedures.
• Annual reporting or certain proxy disclosure about the board of directors’ cybersecurity expertise, if any.

The SEC rule proposal joins what seems to be a laundry list of federal regulatory efforts to formalize cyber incident reporting procedures and processes across several industries. In just the last 12 months, we have reported on numerous executive orders, legislation and proposals, including the three listed below.

Federal Deposit Insurance Corporation (FDIC) Computer-Security Incident Notification Final Rule

The FDIC, the Board of Governors of the Federal Reserve System and the Office of the Comptroller of the Currency (OCC) issued the Computer-Security Incident Notification Final Rule.

FDIC-supervised banking organizations will be required to notify the FDIC no later than 36 hours after the banking organization determines that a computer-security incident that rises to the level of a notification incident has occurred. The final rule takes effect on April 1, 2022, with full compliance extended to May 1, 2022. The FDIC will provide supervised institutions the logistics for the FDIC notification in early 2022.

You can read more about the rule in our recent article. The full copy is viewable at www.fdic.gov/news/board-matters/2021/2021-11-17-notational-fr.pdf.

Cyber Incident Reporting for Critical Infrastructure Act

President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act into law on March 15, 2022. The law requires critical infrastructure entities to report material cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours, and ransomware payments within 24 hours. This is intended to provide the federal government with a better understanding of the nation’s cyber threats and to facilitate a coordinated national response to ransomware attacks.

The full bill is viewable at www.congress.gov/bill/117th-congress/house-bill/5440/text.

Transportation Security Administration Security Directive-Pipeline-2021-01

The Transportation Security Administration (TSA) Security Directive-Pipeline-2021-01 went into effect on May 28, 2021, shortly after the largest ransomware attack in history hit the Colonial Pipeline. It was the first-ever mandatory cybersecurity ruling for pipelines and liquefied natural gas facilities.

The directive requires owners and operators of critical hazardous liquid and natural gas pipelines to conduct a detailed gap assessment of their cybersecurity programs within 30 calendar days of the directive’s effective date. It also requires them to report information and physical security incidents affecting their IT or operational technology systems to CISA within 12 hours of identification.

The full directive is viewable at www.federalregister.gov/documents/2021/07/20/2021-15306/ratification-of-security-directive.

Information on how to report cyber incidents have been around for years. The Department of Homeland Security (DHS) provides plenty of information on how to report cyber incidents in their Unified Message for Reporting to the Federal Government release, so why are there so many efforts on Capitol Hill to formalize cyber incident reporting?

Historically, the majority of private companies have always had the option to report an incident; however, the recent uptick in large-scale attacks and lack of transparency, combined with the negative press— just google “Colonial Pipeline”—has caused a flurry of reactionary actions from federal agencies and regulatory bodies.

The increased focus on industry-specific cyber incident reporting tends to focus on three primary requirements:

• Incident Reporting Time – whether it is 36 hours or weeks, a key requirement is the timeframe from when an organization must disclose a cyber incident to the required agencies following discovery.
• Company Contact – another common requirement we have seen is the designation of a primary contact for cyber incidents and, in most cases, is registered with the appropriate regulatory body for around-the-clock availability.
• Reporting Requirements – the days of hiding incidents is coming to an end, and for good reason. By establishing formal reporting requirements, regulatory and federal bodies capture critical data that can provide important information on how an incident occurred and how to prevent similar ones in the future. The development of the CISA Cybersecurity Advisory Committee indicates that transparency in reporting will be an important theme moving forward.

While the regulations and requirements surrounding cyber incidents will continue to grow across all industries and after each high-profile attack, it will be interesting to see how private and public companies react; and more importantly, if they can meet the requirements and if not, how regulators institute the consequences.

Related Links

• FDIC Computer-Security Incident Notification Final Rule
• Cyber Incident Reporting for Critical Infrastructure Act
• Transportation Security Administration Security Directive-Pipeline-2021-01
• Unified Message for Reporting to the Federal Government

Related Articles

• FDIC Issues Final Computer-Security Incident Notification Requirements for Banking Organizations
• TSA Issues Second Cybersecurity Directive for Pipeline Owners and Operators
• US Lawmakers Look to Set Federal Cyber Breach Alert Standard

About Schneider Downs Cybersecurity

The Schneider Downs cybersecurity practice consists of experts offering a comprehensive set of information technology security services, including penetration testing, intrusion prevention/detection review, ransomware security, vulnerability assessments and a robust digital forensics and incident response team. For more information, visit www.schneiderdowns.com/cybersecurity or contact the team at [email protected].

In addition, our Digital Forensics and Incident Response teams are available 24x7x365 at 1-800-993-8937 if you suspect or are experiencing a network incident of any kind.