As we move into the middle of December, cybersecurity professionals across the globe are bracing for the implementation of new rules set by the U.S. Securities and Exchange Commission (SEC). These rules mandate immediate disclosure in the aftermath of severe cyberattacks, a move which starkly contrasts the commonly chaotic, unclear reality organizations often face post-incident. Furthermore, these rules require annual reports about the potential cyber risks and weaknesses a company might face.
The SEC’s impatience with public companies prioritizing their public image over the security of their customers and shareholders has sparked this new approach. Now, instead of nurturing vague disclosures and manipulation to shield their reputation, companies are obligated to get serious about their cyber resilience. For more detailed insights on the topic, refer to the speech presented by SEC representatives on this matter.
While these changes may present an enhancement for information security policy, there seems to be a certain level of uncertainty within companies. As Orrick partner Aravind Swaminathan points out, organizations might be dealing with a dilemma: the need to share more comprehensive details versus the apprehension of revealing too much. For a more comprehensive look at this, you can check the original article located here.