Cyber has been an historically hermetic practice. A dark art. Full of mysteries and presided over by magicians both good and bad. This is a bit of an exaggeration, yet there is some truth to it. Many in our industry knew that the SEC was evaluating the role that cyber risk management and incident disclosure plays in the pricing mechanism for an equity. Many of the participants in GRC, IRM, and Cyber Risk anticipated this before the SEC had even proposed such rules. Boards, C-Suites, and Information security teams within publicly traded companies brought it up occasionally in the year preceding its adoption. Lawyers on K Street actively advocated in the press against enacting such rules, and there is still a hearty back and forth concerning the merits of SEC involvement in cyber risk. But more transparency is a very welcome development. For investors, it’s essential.
Industry veterans say that this development hearkens back to Sarbanes Oxley, which had very big implications for Governance, Risk, and Compliance. This is likely cyber risk’s SOX moment, and the drop date is December 15th of this year on all 10-K filings. The SEC will not look kindly upon boilerplate disclosures, particularly if a cyber attack with significant losses occurs. So where do you start?
This segment is sponsored by CyberSaint . Visit https://securityweekly.com/cybersaint to learn more about them!
Padraic O’Reilly is Founder and Chief Innovation Officer at CyberSaint, where he leads product innovation and development. His experience as a Harvard-trained economist, risk management consultant, and deep cybersecurity expertise supports his current activity which spans working directly with public and private organizations to assess, measure, remediate, and communicate cyber risk. Working closely with large, highly regulated enterprise teams and CISOs, Padraic is dedicated to driving tangible value through linking cyber risks to control posture, innovating with CRQ models and AI, and enhancing cyber to business communication.
An expert in AI and financial modeling, Padraic works with global enterprises to research and deploy risk quantification, analysis, and communication strategies from board to SEC reporting. Padraic has been featured in publications and broadcasting stations such as CNN, the Wall Street Journal, Forbes, Fortune, the New York Times, and Bloomberg.
Security Weekly listeners: Cyber threats are evolving — is your organization keeping up? The 2023 Cybersecurity Year in Review is Here! Uncover the latest challenges and strategic responses in CRA's 2023 Cybersecurity Year in Review – sponsored by RSA Conference. From the impact of generative AI to the risks of ransomware to navigating new SEC rulings, get ahead for 2024 with your free copy. Download the report at securityweekly.com/yearinreview2023
