SEC cyber disclosure rules transform CISO role
The SEC’s new cyber disclosure requirement puts a burden on CISOs. But, the requirements are also an opportunity for CISOs, whose role is now more strategic than ever.
Published January 30, 2024)
)
)
)
The U.S. Securities and Exchange Commission (SEC) introduced new cyber disclosure rules to require organizations to enhance cybersecurity risk management and disclosure practices. These changes carry big implications for Chief Information Security Officers (CISOs), transforming their role.
Applicable for public companies, the SEC's cyber disclosure rules require IT leadership to report significant cyber incidents within four business days. They also require the organization to outline their cybersecurity risk management strategy in an annual report.
This means that not only must IT leaders make regular, appropriate disclosures, but they also must have the controls and processes in place to determine when disclosures are required in the first place.
Already responsible for securing key digital assets, regulatory pressure now pushes CISOs to the forefront of organizational transparency and corporate governance.
The highly-publicized SEC lawsuit against SolwarWinds' CISO illustrates the biggest change: the organization's responsibility for transparency is tied directly, and personally, to the CISO.
The new cyber disclosure rules undoubtedly put a huge burden and stress on CISOs.
But there's opportunity here too, as this shift puts IT leaders in a strategic position. I unpack this topic further in an article published on InformationWeek.