I am a job seeker on LinkedIn looking for network connections in the cybersecurity field. I want to leave a comment on another LinkedIn post.

Based on the following LinkedIn post, list 10 comments in an authentic, friendly tone so that the LinkedIn user knows I have thoroughly read their post and show genuine interest in the topic.  Prioritize using unorthodox, compelling language with as much detail as possible. Let's take it step by step.

Here is the post: 

SEC has delayed issuing final rules on cybersecurity until 10/2023 at the earliest. This likely resulted from concerns voiced by industry and trade groups about the negative impact of these rules and potential redundancies with other rules that will be coming into effect in 2024. The strict 4-day public disclosure of a “material cybersecurity incident" without exceptions for national security, law enforcement investigations, and for necessary mitigation and remediation could prove detrimental and result in negative consequences to the reporting company, other companies, and the public. According to comments from cybersecurity firm Rapid7, these rules could lead to attack escalation and “copycat attacks on other companies” by other malicious actors seeking to exploit the same vulnerability. As Rapid7 noted in its 8/29/22 comments, “fewer than 100 organizations were actually exploited through the Solarwinds supply chain attack, but up to 18,000 organizations were at risk.”

Many commentators have voiced the importance of these rules so affected persons can take necessary action to protect themselves. But that was never the purpose of these rules. The SEC’s March 2022 Press Release makes clear that its Proposed Cybersecurity Rules were designed to protect investors, not individuals whose information was involved in a data breach. Data breach laws are designed to address those injuries. Unfortunately, the United States still has no federal data privacy law. There are 50 different state data breach laws. Some states further require notification to its Attorney General and the AG then publishes the breach notification letter on its website.

From my experience, many of the objections are valid. Cyberattacks are not typically contained, investigated, and remediated in such a short time frame. Even governmental entities and agencies have difficulty in this regard. Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), companies falling within 16 broadly defined critical infrastructure sectors will be required to report material cybersecurity events to CISA within 72 hours and report any ransomware payment within 24 hours. While these disclosures will not be public, they will provide the government with key information needed to investigate cyberattacks and far more information than they obtain now through voluntary disclosures and mandatory disclosures required in the defense, banking, and healthcare industries.

There is also an increased enforcement landscape -- DOJ's Civil Cyber-Fraud Initiative and its recent first-of-its-kind prosecution of the Uber former Chief Security Officer for the handling of a data breach as well as large civil penalties being imposed by the Federal Trade Commission and State Attorneys General. Companies that do not take cybersecurity seriously and make required data breach notifications also risk significant civil liability through class action lawsuits.