Now that the SEC’s cyber disclosure rules are in effect, companies are still working through their approaches to compliance. You may be a CISO tasked with getting your team up to speed quickly amid tight staffing and security budgets, emerging technology and a growing threat landscape. If you find it difficult to go it alone, integrating managed services into your cybersecurity operations can help your organization establish trust, maintain transparency and simplify future reporting obligations as they arise.
The SEC’s final rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure puts the onus on companies to give investors current, consistent and “decision-useful” information about how they manage cyber risks. A managed services provider can quickly provide the people, processes and technology to help establish a sustainable, consistent practice and the speed to keep pace with evolving regulations.
Filling the gaps to meet the new cyber standards
For a cybersecurity program to be truly mature, processes need to be tested and easily replicated to quickly determine and report the materiality of an incident. A managed services provider can continuously adapt its services to provide you process consistency and integrity.
Managed services providers offer round-the-clock support and can help scale and strategize. Yet only 25% of companies are establishing protocols with major technology providers (e.g., cloud, device manufacturers, managed services) to coordinate an incident response, according to PwC’s 2024 Global Digital Trust Insights survey. It’s not just about using managed services, but as a CISO determining how to effectively work with a third party to achieve the desired return on these investments.
Harmonizing dozens of processes and investments as part of a larger, dynamic system can help accelerate preparation, streamline operations and maintenance, and strategize. An effective managed services provider can help close capability gaps, better control your technology spend and can help derive greater return on investment (ROI).
Here are a few scenarios to consider as you think through your needs:
Talent upskilling, augmentation
Large organizations may face eight to ten regulatory changes on an annual basis. Hiring additional in-house talent and bringing them up to speed to meet each challenge may be neither practical nor cost-efficient, and the ongoing cycle of various certifications can impact employee morale. Ask yourself:
- Are we ready to fulfill new regulatory requirements?
- Are we creating systems and processes from scratch?
- Do we have the capacity to run a multiyear operational system?
Expanding oversight
In addition to issuing the final disclosure rule in July, the SEC has increased its enforcement division to focus on compliance with existing securities laws. This comes as stakeholders — consumers, investors, CEOs and boards — also demand more information about how companies manage cyber risk exposure. It’s increasingly important for the CISO to identify resources to enhance your external cyber reporting capabilities.
The final rule requires that, in annual 10-K filings, all SEC registrants reporting under the Securities Exchange Act of 1934 describe the processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, management’s role in assessing and managing those risks, and the board of directors’ oversight of risks from cybersecurity threats. It also requires prompt disclosure of material cyber incidents on Form 8-K — within four business days of determining that an incident is material.
Cybersecurity program lifecycle
Assess
- Assess your current security event monitoring and detection processes to confirm that your technology and processes are aligned to meet the requirements around disclosure of cyber incidents within four business days of determining an incident is material.
Build
- Build a robust program, one that can be tested, repeated over time and that will assist you in understanding the materiality and reporting of an incident.
- Use tabletop exercises and simulations to stress-test your processes.
Activate and maintain (managed services)
- Whether in-house or handled by managed services, this element requires a highly skilled workforce that is always available to detect, respond and triage those alerts.
- Manage the monitoring program continuously to provide support for investigating and reporting as required.
Effective date: Material incident disclosure requirements are effective as of December 18, 2023. Smaller reporting companies have a 180-day deferral.
Advantage: A well-managed security operations program helps establish trust when a material incident is reported in a timely manner.
In a nutshell
Bottom line
Cybersecurity is often addressed episodically, when an audit occurs or a breach happens, rather than continuously. With each new regulation, some organizations form a separate team to address it, paving the way for bad actors to enter and narrowing your ability to build transparency and confidence with employees and consumers. Failing to respond persistently is like locking the front door and leaving the back door open. Working with a managed services provider can facilitate compliance that’s necessary to build stakeholder confidence and trust.
The role of the CISO and the security team is increasingly vital to the lifeblood of the organization. By strategically integrating managed services into your operations, you have an opportunity to foster a culture of continuous improvement in cybersecurity. This means taking a top-down approach and investing in the resources and support needed to safeguard against potential threats and vulnerabilities, report with confidence and manage a mature operating program. The SEC’s new cyber disclosure rule is your opportunity to get ahead of the next regulatory update by working closely with a managed services provider.
Contact us
