In a remarkable shift, the U.S. Securities and Exchange Commission (SEC) has placed SolarWinds Corp. (SolarWinds) and the company’s chief information security officer (CISO) under charge. They are blamed for securities fraud and contraventions of internal controls requirements, resulting from alleged failures to divulge known crucial cybersecurity risks and vulnerabilities. Read about the case from Davis Wright Tremaine LLP on JD Supra.
The charges do not only pertain to the defendants’ activities relating to the widely reported SUNBURST attack in 2020, but they also encompass broader allegations. This development conduces rigorous thoughts and conversations on the evolving responsibilities and potential liabilities of public companies and their security professionals.
Closer scrutiny reveals significant implications for CISOs and other key professionals responsible for cybersecurity. As the SEC charges highlight, these individuals potentially face personal liability issues, which could include securities fraud, for failures to disclose material cybersecurity risks and incidents.
Moreover, the SolarWinds case is a clear reflection on the heightened emphasis placed on the extent and quality of internal control over cybersecurity risk disclosure practices. Companies should consider reviewing their policies and procedures pertaining to the disclosure of material cybersecurity risks and incidents, in light of these emerging trends. These procedures must be robust enough to withstand the SEC’s scrutiny.
To summarize, the SolarWinds case sends a clear signal of an emerging trend, which includes more scrutiny on companies and their security professionals regarding the disclosure of cybersecurity risks. It is the responsibility of public companies and security professionals to ensure material information is disclosed to stay in compliance.