Cybersecurity Systems and Risks Reporting Act

To amend the Sarbanes-Oxley Act of 2002 to protect investors by expanding the mandated internal controls reports and disclosures to include cybersecurity systems and risks of publicly traded companies. 1. Short title This Act may be cited as the Cybersecurity Systems and Risks Reporting Act 2. Cybersecurity and information system requirements (a) Definitions Section 2(a) of the Sarbanes-Oxley Act of 2002 ( 15 U.S.C. 7201(a) (1) in paragraph (2), by inserting after financial statements and information systems (2) in paragraph (3)(A), by striking and financial , financial, and cybersecurity systems (3) in paragraph (10)(B), by inserting after quality control policies and procedures, cybersecurity systems standards and practices, (4) by adding at the end the following: (18) Information system The term information system (19) Cybersecurity system The term cybersecurity system (20) Cybersecurity risk The term cybersecurity risk . (b) Corporate responsibility Section 302 of the Sarbanes-Oxley Act of 2002 ( 15 U.S.C. 7241 (1) in the heading of such section, by inserting after REPORTS AND INFORMATION SYSTEMS (2) in subsection (a)— (A) by striking and the principal financial officer or officers, , the principal financial officer or officers, and the principal cybersecurity systems officer or officers (B) in paragraph (4), by striking internal controls internal controls and cybersecurity systems (C) in paragraph (5)— (i) in subparagraph (A)— (I) by inserting after operation of internal controls and cybersecurity systems (II) by inserting before the semicolon the following: and any significant cybersecurity risks in issuer's information systems (ii) in subparagraph (B), by inserting before the semicolon the following: , cybersecurity systems, or information systems (D) in paragraph (6)— (i) by striking internal controls internal controls, cybersecurity systems, or information systems (ii) by striking significant deficiencies cybersecurity risks, significant deficiencies, (c) Management assessment Section 404 of the Sarbanes-Oxley Act of 2002 ( 15 U.S.C. 7262 (1) in the heading of such section, by inserting after CONTROLS AND INFORMATION SYSTEMS (2) in subsection (a)— (A) by inserting after contain an internal control and information systems (B) in paragraph (1), by striking an adequate internal control structure and procedures for financial reporting adequate internal control and cybersecurity systems structures and procedures for financial and information systems reporting (C) by amending paragraph (2) to read as follows: (2) contain assessments, as of the end of the most recent fiscal year of the issuer, of the effectiveness of— (A) the internal control structure and procedures of the issuer for financial reporting; and (B) the cybersecurity systems structure of the issuer. ; and (3) in subsection (b)— (A) in the heading of such subsection, by inserting after Internal Control and Cybersecurity Systems (B) by striking internal control assessment internal control and cybersecurity system structure assessments (d) Disclosure of expert Section 407 of the Sarbanes-Oxley Act of 2002 ( 15 U.S.C. 7265 (1) in the heading of such section, by striking EXPERT AND CYBERSECURITY SYSTEMS EXPERTS (2) in subsection (a)— (A) in the heading of such subsection, by striking Expert and Cybersecurity Experts (B) by striking , as such term is defined by the Commission and at least 1 member who is a cybersecurity systems expert, as such terms are defined by the Commission in consultation with the Secretary of Homeland Security and the Secretary of Commerce (3) by striking subsection (c) and inserting the following: (c) Considerations with respect to cybersecurity experts In defining the term cybersecurity expert (1) an understanding of generally accepted principles, practices, and law relating to computer security, computer network security, and data security and privacy; (2) experience in— (A) the preparation of information systems audits for cybersecurity risk discovery; and (B) the maintenance, implementation, and monitoring of information systems and their cybersecurity systems; (3) experience with information systems aspects of internal accounting controls; and (4) an understanding of audit committee functions. . (e) Enhanced review Section 408 of the Sarbanes-Oxley Act of 2002 ( 15 U.S.C. 7265 (1) in subsection (a), by striking financial statement financial, information systems, and cybersecurity systems statements (2) in subsection (b)— (A) in paragraph (5), by striking and (B) by redesignating paragraph (6) as paragraph (7); and (C) by inserting after paragraph (5) the following: (6) issuers that have issued cybersecurity risks disclosures; and . (f) Clerical amendment The table of contents in section 1(b) of the Sarbanes-Oxley Act of 2002 is amended— (1) in the item relating to section 302, by inserting after REPORTS AND INFORMATION SYSTEMS (2) in the item relating to section 404, by inserting after CONTROLS AND INFORMATION SYSTEMS (3) in the item relating to section 407, by striking EXPERT AND CYBERSECURITY SYSTEMS EXPERTS

Summary: Cybersecurity Systems and Risks Reporting Act This bill amends the Sarbanes-Oxley Act of 2002 to apply to cybersecurity systems and cybersecurity systems officers the same requirements regarding corporate responsibility for financial reports and managements assessments of internal control structures and procedures for financial reporting as apply to public companies subject to oversight by the Securities and Exchange Commission (SEC). The SEC shall issue rules to define cybersecurity expert and require each issuer of securities to disclose whether or not (and if not, the reasons why) the issuer's audit committee has at least one member who is a cybersecurity expert. The SEC shall review an issuer's information systems and cybersecurity systems statements. In scheduling the such reviews the SEC shall consider, among other things, issuers that have issued cybersecurity risks disclosures.