SEC Rules on Cybersecurity: Materiality, Preparedness and Board Oversight
summary
CrowdStrike’s tracking of post‑Dec 2023 filings shows many companies file 8‑Ks rapidly while still calling materiality “unknown,” so build an escalation from SOC → CSIRT → materiality committee with iterative reconvenes, documented templates and preserved logs; include SEC/white‑collar counsel. Examples that tip materiality: missed manufacturing quotas, lost hourly e‑commerce revenue, TV ad dollars, R&D experiments ruined, or data posted on leak sites. Treat 10‑K cyber risk text as factual, start early and map cyber to enterprise risk. four‑day rule
AI-written summary · about
chapters (27)
- 0:00SEC cybersecurity disclosure rules
- 1:04SolarWinds case impact
- 2:32CISO liability under SEC rules
- 5:228-K disclosure trends since 2023
- 7:10Materiality criteria for cybersecurity
- 8:13Materiality assessment processes
- 10:39Documentation in materiality decisions
- 13:12Who decides materiality
- 16:04Key materiality factors
- 17:30InfoSec on materiality factors
- 19:42Financial impact calculations
- 25:51Avoiding half-truths in filings
- 27:17Legal and security team collaboration
- 28:47Regulatory legal considerations
- 30:12Third-party materiality analysis
- 31:41Incidents affecting customers more
- 33:04Reputational impact control
- 34:49Shift from 8-K to 10-K disclosures
- 35:1010-K disclosure risks
- 37:19Crafting 10-K cybersecurity disclosures
- 41:59Known unknowns in risk management
- 43:02Cyber risk mapping to ERM
- 44:28Improving cybersecurity risk processes
- 45:34Tabletop exercises for materiality
- 46:17CISO board reporting and litigation
- 48:04SEC breach notification evaluation
- 50:10Third-party risk management
related talks
49mCybersecurity in the Boardroom - The Impact of the Latest SEC Proposal
42mPreparing for the New Era of Cybersecurity Disclosure
51mDo Better: Board-Level Accountability in Cybersecurity
27m4 Panel Session - Bridging Policy and Practice
40mCybersecurity Metrics Development for Board and Risk Committee Reporting
49mHow to Create a Breach-Deterrent Culture of Cybersecurity, from Board Down
35mMeasuring change: Responding to cyber material risk
30mRisk, Evidence and Conformity