Chief Information Security Officers (CISOs) must align with regulations such as the SEC’s cybersecurity disclosure rules, CIRCA’s reporting mandates, and the Sarbanes-Oxley Act’s whistleblower protections. Integrating compliance automation and building robust cybersecurity programs are essential strategies for navigating these regulatory landscapes.

1. The Role of SEC Cybersecurity Requirements

The changing environment in U.S. securities regulation is now impacting the operations of public companies and their chief information security officers (CISOs). The latest tweak in the SEC’s long history of regulating the capital markets in the U.S. now requires that public companies disclose serious cybersecurity incidents that have or will have an effect on their business and the information that they provide to investors. And so these latest regulations directly affect how CISOs plan and report on cyber events, both to the public and to the companies that they serve.

Beginning on September 5, 2023, the SEC has new rules in place that highlight the need for clear and direct accountability concerning cybersecurity issues that public companies face. Now public companies must report any material cyber incidents on Form 8-K within four business days of their occurrence. There is one major exception to this rule: if national security is at stake, public companies may postpone the incident disclosure for the time being. Another new requirement tied to this same rule is Regulation S-K Item 106, which requires public companies to describe their cybersecurity management strategies—particularly the role that the company’s board of directors plays in overseeing cybersecurity issues. Findings.co outlines these mandates effectively.

Following these dictates, CISO processes must adapt.

• Align reporting mechanisms: Organizations need to meet the four-day reporting requirement for material cybersecurity incidents, necessitating reliable incident detection and reporting systems.

• Annual assessments: Firms are expected to disclose cybersecurity risk assessments regularly, maintaining a comprehensive view of their cyber risk posture.

• Board involvement: Clear communication with the board about cybersecurity risks is paramount, formalizing board oversight practices.

• Proactive measures: Investing in initiatives such as bug bounty programs ensures early identification and mitigation of threats, as suggested by professionals on the Logical Advice for CISOs webinar.

“The straightforward directive from the SEC concerning incident reporting lessens any uncertainty and directs organizational responsibility—both of which are essential to any navigation through today’s treacherous waters of cybersecurity.” — Gaurav Banga.

The SEC’s regulations can be difficult to comply with because they are both extensive and complex. However, compliance is key—not just because the SEC can impose punishing remedies for noncompliance but because the vast system of interconnected financial markets ultimately only functions well when all of the participants play by the same set of rules. Indeed, it is a confidence game, and the SEC is the agency responsible for keeping the players confident in the integrity of the game.

2. Navigating Cybersecurity Disclosure Mandates

The Chief Information Security Officer (CISO) has the crucial job of managing the mandates for cybersecurity disclosures. Under the new rules put forth by the Securities and Exchange Commission (SEC), publicly traded companies must ensure their disclosures related to cybersecurity incidents and risk compliance follow the SEC’s orders. Potential legal “reputational liabilities” hang in the balance, for CISOs and for their companies.

Two main problems exist. One is with understanding the disclosure required of public companies under Form 8-K Item 1.05. This form mandates public companies to disclose any significant cybersecurity incident within four days of its occurrence unless certain exceptions apply.

In order to take these new requirements in hand and manage them effectively, companies are adopting much more effective methods for keeping tabs on what might happen to their systems, and they are also improving their incident response measures. Compliance with these rules is something all public companies will have to work at, and tools like Findings can help make that work a little easier.

A systematic methodology for assessing an incident’s importance mitigates the risk of inaccurate reporting. The SEC defines the importance of an incident based on its potential to affect an organization’s financial situation. This serves to protect investors and ensures a level of transparency that meets the standards set by authorities worldwide.

“Effective cybersecurity hinges on more than just solid policies and procedures. It also requires consent and commitment from those across the organization to achieve a clear and timely line of communication with stakeholders.” — Sheila Colclasure, Vantage Risk

Working in tandem with the legal, IT, and risk management departments guarantees that everything is on track concerning the rules and regulations that the organization must follow. For CISOs, it is imperative to remain both informed and adaptable if they are to successfully safeguard their institutions.

3. Aligning with CIRCA’s Reporting Rules

CIRCA mandates reflect the important evolution of America’s cybersecurity regulations, especially regarding the incident reporting of recent and historical cyber attacks. Enacted in 2022, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) requires some entities to report certain cyber incidents and covered ransomware payments to CISA. This CISA reporting requirement is intended to “enhance the national cybersecurity posture by ensuring that the federal government can respond quickly to serious cybersecurity threats and incidents.”

The Cyber Incident Reporting Council (CIRC), a part of the Department of Homeland Security (DHS), has laid out some of the most essential steps toward basic cyber hygiene that private companies can take. Of course, “basic cyber hygiene” applies to the federal government as well; however, the private sector is where the most significant number of potential victims of cyberattacks resides. These recommendations aim to streamline the reporting process, make it simpler to understand, and reduce the overlap of different federal agencies wanting to be notified when something bad happens.

CISA’s role does not stop simply at enforcing the mandate. It takes trend analysis a step or two upstream from the incoming reports. It attempts to see what is happening across various sectors into which it has insight. Then it levels with the president’s private sector advisory council and with us out here in public view. Since this agency operates under the auspices, both physical and governmental, of the Department of Homeland Security, confident “goods news” advisories can be vouchsafed along two highways: 1. to the president, and 2. to us, the public.

Homeland Security Secretary Alejandro N. Mayorkas underscores the critical need for information sharing to be consistent. He said:

Right after a cyber-attack, we need it to be made clear to our private partners exactly what we expect of them in terms of sharing information to get to the bottom of things quickly and to limit the damage done. The Department of Homeland Security has just laid out some guidelines; more on that in a moment. [source]

When the CISO goes along with CIRCA’s reporting rules, what they are doing is increasing the chances that, come what may, they will not personally end up on the wrong end of a lawsuit. And so, one might say, they are playing for cover while at the same time doing what is necessary in order to play a useful part in the defense of critical infrastructure against cyberattack.

4. Leveraging Findings for Compliance Automation

Finding offers a resolution for CISOs trying to work their way through the intricate and convoluted regulatory framework hewing to so many cybersecurity rules and guidelines. It does this with tools that enable continuous monitoring and compliance automation. Why does this matter? Because maintaining compliance is climbing toward  $52 per employee by 2024. Automation has to become indispensable.

The challenges of human error and swiftly changing regulations are to be solved by automation. Now, automation can mean any number of things, but when we talk about it here in the security context, we mean findings. Findings are what we streamline to reduce the costs of security and the fatigue of security teams. We are what free them up to do their real work—the work of assessing risk, responding to incidents, and reporting on what has happened in a way that makes sense to someone who isn’t a part of the security team.

Ensuring adherence to regulations during non-standard working hours necessitates ongoing supervision, addressing the cybersecurity skills shortage. Compliance in all aspects of security and safety is crucial when automation is involved, particularly in the contexts of industry and commerce. When integrations with artificial intelligence are present, the need to ensure secure operations and to detect and respond to threats is multiplied. A compliant system now is much safer than a noncompliant one will be in the future. Failure to ensure those safeguards early means that more resources must be diverted later to address any problems that might arise.

Zac Amos, in an article for ReHack, states, “The accelerating pace of regulatory change, the increased costs associated with compliance, and a severe scarcity of skilled professionals are pushing some enterprises to the brink. Fortunately, automation is helping firms not only to keep up but also to stay in front of regulatory demands. This technology can help organizations achieve something that is truly ‘alive and well’ in the ‘automation era’: achieving cybersecurity compliance.”

Automated tools such as Findings offer a competitive advantage, enabling chief information security officers to maintain the upper hand in ensuring cybersecurity compliance.

5. Sarbanes-Oxley and Whistleblower Protections

The measures contained in the Sarbanes-Oxley Act of 2002 (SOX) seek to ensure not only that public companies provide full and fair disclosures but also that reports of alleged wrongdoing will be made without fear of payback. Although the act is best known for its accounting provisions, it includes remarkably potent anti-retaliation protections that put an umbilical cord between the U.S. Department of Labor and the federal courts. JD Supra

SOX provides a safe environment for whistleblowers to report financial misconduct. For CISOs, keeping their companies compliant with SOX is easier said than done. It involves overcoming the risks and corporate cultural obstacles that SOX whistleblowers present. Hearing about these two aspects of SOX—corner cutting and culture—will help us understand the two principal reasons that the law does not work very well.

The retaliation prevention measures in SOX give whistleblowers an effective way to protect themselves from retaliation. As Dr. Nick Oberheiden explains, these measures allow whistleblowers to have legal recourse if they face retaliation after reporting their concerns.

“Claims for retaliation against whistleblowers under the Sarbanes-Oxley Act often lead to substantial settlements or awards, and a lot of them involve amounts of more than a million dollars.”

Trust is essential for both organizations and employees. They both want to know that sensitive information, especially private data about individual employees, is not going to be seen by anyone who doesn’t need to see it. That’s a fundamental aspect of any supportive work environment. But organizations also need to trust that all employees are going to comply with the rules governing that sensitive information. And that’s a fundamental aspect of any environment that supports rule compliance. Tripwire