Making Sense of the New SEC Cybersecurity Rules and What They Could Mean for Your Company

By Paul Kurtz

The United States Securities and Exchange Commission’s (SEC) July 26 approval of new cybersecurity “incident” disclosure rules is top of mind for every public company, and understanding what it means and how companies will be held accountable is crucial. The rules were initially introduced in March 2022 but the Commission’s deliberation on disclosing cyber incidents began over ten years ago. Let’s dig into it.

The new rules, which will go into effect later this year, require that publicly-traded companies (or “registrants”) disclose a “material” cybersecurity incident within four business days of determining an incident was material. There is an exception to the reporting timeline, which allows for a delay if disclosing the incident could harm national security or public safety. However, only the United States Attorney General must grant such an exception.

What is most interesting is that registrants must disclose the impact of a material cybersecurity incident but are not required to disclose the technical details, such as the vulnerabilities exploited or the indicators of compromise.The rules will require the registrant to “describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.”

In addition to cyber incident disclosure requirements, the SEC also mandates that public companies periodically disclose information regarding their cybersecurity risk management, strategy, governance and risk factors.

The upshot of the new rule means that while companies do not have to disclose the technical details of an incident, they need two capabilities to respond and report on a timely basis:

First, given time is of the essence — with a four-day window to report once a cybersecurity incident is deemed material — each company must be able to rapidly gather and analyze telemetry from various tools and sources to classify an event and determine if it’s material and requires SEC reporting. This will require an extremely coordinated and sophisticated cross functional team.
Second, resilience is critical. A company that can pursue a resilience strategy will have less angst over a disruption if it can quickly identify a problem and leverage backup capabilities, potentially obviating the need for reporting if there would be no material impact on investors. Perhaps a new tongue-in-cheek acronym is warranted: reduce Mean Time To Detect, Respond to Obviate Reporting (MTTD-ROR).

A Roadmap to Rapid Resilience

Service disruptions often look the same, but internal teams need help to obtain the holistic view required to solve a problem quickly. The field is crowded with players in roles ranging from business leaders, security, operations, IT, and audit, to engineers, developers, and architects. So how do you prepare and recover from unexpected cyber disruptions quickly?

It starts with public companies adequately investing in the right people, technology and processes that enable cyber resilience. This makes it possible for SecOps, ITOps, and engineering to collaborate with the right tools to prevent significant issues, remediate quickly, and accelerate transformation.

The new SEC rules drive publicly-traded companies — like Splunk — to take a resilient-first technology approach that enable improved visibility of IT and OT infrastructure, including:

Full-scope visibility, a realtime, automated understanding of security and observability events whether on-premises, in the cloud, or hybrid.
Seamless integration of security analytics, threat intelligence, powerful investigation capabilities, and SOAR supported by a modern unified work surface to differentiate an incident orchestrated by a malevolent actor versus an operational problem such as a software glitch or misconfiguration.

Click here to learn more about Spunk’s ability to help increase your cyber resilience and help meet the SEC’s disclosure requirements.

Paul Kurtz

Paul has led organizations involved in the most pressing national security issues, ranging from counter-terrorism, weapons nonproliferation, critical infrastructure protection, and cybersecurity.

His management experience spans government, non-profits, to the private sector, ranging from Special Assistant to the President on the White House's National Security Council to managing partner for a consulting company's overseas operations to founding a venture-funded cybersecurity company.

Career highlights include experience on the ground as a weapons inspector in Iraq and North Korea, serving as Political Advisor in Northern Iraq, coordinating the immediate response to the attacks of September 11, planning a national cyber defense program, to turning an idea to automate cyber intelligence management into a successful company (TruSTAR) ultimately acquired by Splunk.

Security 2 Min Read

Splunk Security Use Cases

Security 2 Min Read

Splunk’s Response to the SolarWinds Cyberattacks

Although Splunk was not directly affected by the SolarWinds cyberattacks, as a leader in security we want to help the industry by providing tools, guidance and support to those impacted. Splunk's CISO Yassir Abousselham shares relevant information for customers and examples of how Splunk has taken action to better protect its business.

Security 3 Min Read

Cybersecurity’s Moneyball Transformation

What do baseball and cybersecurity have in common? Nothing, at first glance. But, take a deeper look and you can see the glaring similarities. That's because cybersecurity is going through its Moneyball transformation right now. Read this blog post to learn more.

About Splunk

The world’s leading organizations rely on Splunk, a Cisco company, to continuously strengthen digital resilience with our unified security and observability platform, powered by industry-leading AI.

Our customers trust Splunk’s award-winning security and observability solutions to secure and improve the reliability of their complex digital environments, at any scale.