[ad_1]
\n<\/p>\n
The Securities and Exchange Commission has <\/span><\/span><\/span><\/span><\/span><\/span>postponed until October<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a> a final rule that would require publicly traded companies to report material cyber breaches and attacks in regulatory filings.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n The rule, initially proposed in March 2022, would require public companies to submit a filing within four days of determining whether a cyber breach is material.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n As part of that proposal, the SEC also sought additional <\/span><\/span><\/span><\/span><\/span><\/span>disclosures from companies regarding their cyber governance<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a>, including board expertise and upper management involvement in cyber risk.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n The SEC also proposed investment companies and advisors adopt written cybersecurity policies in February 2022.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n The proposal stemmed from years of companies delaying or failing to disclose significant cyber breaches or ransomware attacks.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n Companies have historically only reported about one-quarter of ransomware attacks to public authorities, <\/span><\/span><\/span><\/span><\/span><\/span>according to a report from the U.S. Senate released in 2022<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a>.\u00a0These incidents have largely been kept confidential, with arranged ransom payments to avoid data disclosures, consumer or investor lawsuits and reputational harm.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n IT security experts say the delay will increase the level of risk, because many investors, consumers and companies will rely on voluntary disclosure of major cyberattacks.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n \u201c<\/span><\/span><\/span><\/span><\/span><\/span>Without the hammer the SEC regulations can bring, reporting breaches will continue to be voluntary and historically that doesn’t work,\u201d Gary Barlet, field CTO, federal at Illumio, said via email.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n SEC officials have not publicly stated the reasons for the delay, but there has been significant pushback from various stakeholders regarding the four-day disclosure proposal.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n Some organizations, like cybersecurity firm Rapid7, argued the proposed disclosure rules would risk making ongoing attacks part of the public record. Therefore, disclosure would potentially tip off criminal hackers if a company was required to go public before the incident was contained.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n Rapid7 officials asked the SEC for the ability to <\/span><\/span><\/span><\/span><\/span><\/span>let companies delay disclosure<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/a> until attacks were mitigated.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n<\/p><\/div>\n