What CISOs must
know to comply with
new SEC cybersecurity
disclosure rules

Public companies are busy shoring up theircybersecurity operations and documenting theircybersecurity risk management and incident disclosure
processes to comply with new U.S. Securities andExchange Commission (SEC) requirements after theSEC adopted final rules to enhance and standardize
disclosure about cybersecurity incidents.
This is especially true after the SEC’s decision to chargea software company and its chief information security
officer (CISO) with fraud due to misleading disclosureof the company’s cybersecurity practices and failure todisclose known cybersecurity risks.
For CISOs, pressure is rising to document incidents andquantify their potential effects.
When the SEC finalized its cybersecurity disclosurerules last summer, it introduced a requirement for publiccompanies to disclose their processes used to assess,
identify and manage material cybersecurity risks—alongwith the related board oversight of those risks andmanagement’s role in assessing and managing thoserisks. The new rules also put in place a four business
day countdown clock for disclosing cybersecurity
incidents when they are deemed material.
The challenge for CISOs and companies’ disclosure
teams is in quantifying the effect of a cybersecurity
incident to assess materiality and how best to
adapt to and comply with new SEC disclosure andreporting requirements.

Materiality and the four business dayreporting requirement
To overcome the challenges, CISOs must first realizethat the new SEC rules require disclosure of “material”
cybersecurity incidents, not all incidents. Materiality isdetermined based on standards in U.S. case law andgenerally refers to what a reasonable investor would
consider material in making an investment decision.
“This is worth close examination and legal review,” said
Sam Junkin, Global GRC Practice and Americas GRC
Delivery Leader for Verizon Cyber Security Consulting.
To reach a materiality determination, companies
should enlist cross-functional stakeholders, including
the CISO, the board of directors and C-suite, legal,
public relations, and other partners whose involvement
will help inform which incidents meet the materiality
threshold. Because SEC rules focus on material
incidents, which often affect an organization’s brand,reputation, revenue or stock price, “being able toquantify those factors is key,” Junkin said.

It’s important to note that the four business day deadline
for disclosure only starts after the company determinesthat an incident is material. In other words, as soon
as you determine that a specific event meets themateriality threshold, that’s when the timer starts fordisclosing the incident.
It’s crucial to build an effective plan for compliance with
the new cybersecurity disclosure requirements. This iswhere third-party support and validation can help CISOs
put the right cybersecurity controls in place. This will aid
in compliance not just for the SEC rules but for various
other regulatory oversight requirements as well.

What CISOs need to know to comply,
lower risk and quickly respondto incidents
As regulatory scrutiny rises and organizations, alongwith their CISOs, work to avoid growing penalties
for lack of compliance, the best path forward is tobe prepared. “CISOs must now prepare for material
breaches before they happen and not wait until aftera cyberattack to respond,” Junkin said.
This is where Verizon is uniquely well-positioned to help.
As a leading cybersecurity provider, Verizon provides
comprehensive cybersecurity support services andpatented, award-winning solutions to help CISOs quickly
respond so they can:• S treamline compliance. To make the efforts involvedin achieving regulatory compliance easier, CISOs
must understand and quantify the effect of a breach,
including the costs of downtime. Verizon’s Cyber
Risk Programs and governance, risk and compliance(GRC) teams can help CISOs quantify the effect ofbreaches across nearly every industry. CISOs canrely on these quantifiable points to help persuade
their boards and other key decision-makers about
the importance of cybersecurity protection. “Ascompliance requirements grow, honing in on ways
to standardize and streamline compliance acrossyour organization’s specific oversight requirements isparamount,” said Junkin.
In addition to current Cyber Risk Programs andGRC solutions and services, Verizon is launching an
automated cyber risk quantification tool to furtherstreamline breach quantification for CISOs.

2• Reduce threats upfront. To reduce rising threats andregulatory requirements, CISOs must improve riskmanagement. Verizon offers a broad array of support
services and solutions, such as its integrated threat
intelligence and Managed Detection and Response
services. These solutions enable CISOs to wrap theirarms around the steps needed to proactively prepare
for incidents and continually monitor and track
activities across an organization’s attack surface.
Verizon Managed Detection and Response provides
always-on protection that can help quickly identify
security incidents and limit their impact.
• Quickly respond to incidents. CISOs need multiple
skilled resources to respond quickly to incidents.
Hiring and retaining security experts, however, is aserious challenge. And in the event of a large data
breach, even a fully staffed team can need help.
To overcome staffing issues, Verizon offers Rapid
Response Retainer services, providing much-needed
incident response support when organizations
discover a breach. Verizon’s incident response teamcan help CISOs establish where a breach occurred,understand how it came into the organization anddetermine how long the threat actor was insideorganizational networks. This service was designed
to help reduce the time it takes to respond to andlimit the scope of an incident as well as to respond
more effectively. Rapid Response Retainer not only
augments your response team but also gives CISOs
additional investigative capabilities.
“It no longer makes sense to try to keep every aspectof cybersecurity in-house,” Junkin said. “A partneredapproach enables CISOs to augment their core teamwith on-demand capabilities that are usually quitehard to find,” he added.

Verizon stands ready to help. We keep up with therapidly changing nature of cyber threats by processing
billions of security events each year, analyzing evolving
threats at our global security operations centers,
performing forensic investigations for companies
around the world, and sharing our knowledge throughindustry-recognized research and advice as publishedin Verizon’s annual Data Breach Investigations
Report (DBIR).

If you have questions or need help, contact yourVerizon Business Account Manager, reach outto us here or learn more by visiting verizon.com/business/products/security.

In the event of an incident, CISOs can enlist Rapid
Response Retainer support via a mobile app ora 24/7 emergency hotline or by contacting theirdesignated liaison. It’s also important to note that
Verizon is vendor-agnostic. Rapid Response Retainer
works with any security technology already in placeand can help guide incident response across a
CISO’s entire organization. When an incident occurs,
it will also help shift the narrative from reacting
to proactively preparing to respond and disclose
cybersecurity incidents.

This material has been prepared for informational purposes only, and is not intended to provide, and should not be relied on as, legal advice. You should consult your own legal advisors forguidance on SEC compliance matters, including compliance with the SEC’s cybersecurity disclosure rule.
© 2024 Verizon. OGAR0380124
3