One Article Review
| Source |  AlienVault Lab Blog |
|---|---|
| Identifiant | 8374424 |
| Date de publication | 2023-08-25 10:00:00 (vue: 2023-08-25 10:06:32) |
| Titre | La SEC exige plus de transparence sur les incidents de cybersécurité dans les entreprises publiques The SEC demands more transparency about Cybersecurity incidents in public companies |
| Texte | The Securities and Exchange Commission (SEC) has introduced a new rule for public companies that requires them to be more transparent about cybersecurity incidents. The new rule requires companies to disclose any material cybersecurity incidents within four business days of that determination. The disclosure should describe the material aspects of the incident, including the nature of the incident, the impact on the company, and the company\'s response. The SEC\'s proposed rules include written cybersecurity policies and procedures, IT risk assessments, user security, and access controls, threat and vulnerability management, incident response and recovery plans, board oversight, recordkeeping, and cybersecurity incident reporting and disclosures. To help CISOs incorporate this requirement seamlessly into their existing incident response plan, here are some actionable tips: Revisit your incident response plan: An incident response plan is a structured approach that outlines the steps you\'ll take during a security breach or other unexpected event. Your business may be unprepared for a security incident without a response plan. An effective plan helps you identify and contain threats quickly, protect sensitive information, minimize downtime, and lessen the financial impact of an attack or other unexpected event. Update the notification procedure and proactive planning for notification: Craft a well-defined notification procedure outlining the steps to comply with the SEC\'s requirement. Assign roles and responsibilities for crafting, approving, and forwarding notifications to relevant parties. Develop communication templates with pre-approved content, leaving room for incident-specific details to be filled in during a crisis. Material incident identification and impact: Define the criteria for determining materiality, including financial, reputational, and operational implications. This step is critical in meeting the tight four-day reporting deadline. Data protection and disclosure balance: Develop protocols to protect confidential information during public disclosures and collaborate closely with legal counsel to ensure compliance with disclosure regulations. Regular plan reviews and third-party assessments: Regularly update your incident response plan to stay abreast of evolving threats and compliance requirements. Engage external cybersecurity experts to conduct thorough assessments, identifying gaps and potential vulnerabilities that need immediate attention. Conduct tabletop exercises: Organize tabletop exercises that simulate real-world cybersecurity incidents. Ensure these exercises involve the business aspect, focusing on decision-making, communications, and incident impact assessment. These drills will sharpen your team\'s skills and enhance preparedness for the new 4-day deadline. Foster a culture of cybersecurity awareness: Cultivate a company-wide culture that prioritizes cybersecurity awareness and incident reporting. Encourage employees to report potential threats promptly, empowering your team to respond swiftly to mitigate risks. To determine your readiness posture, ask yourself the following questions: Incident reporting and management questions What is your process for reporting cybersecurity incidents? How can you effectively determine the materiality of a breach or attack? Are your processes for determining materiality thoroughly documented? Have you determined the right level of information to disclose? Can you report within four days? How will you comply with the requirement to report related occurrences that qualify as "material"? Incident management policies and procedures Are your organization\'s policies and procedures, risk assessments, controls, and controls monitoring strong enough to disclose publicly? Are your policies and procedures aligned |
| Notes | ★★ |
| Envoyé | Oui |
| Condensat | about abreast access actionable activities against aligned allocations any applied approach approved approving are ask asking aspect aspects assess assessment assessments assessments: assign attack attention awareness awareness: balance balance: board breach business can capabilities capital cisos closely collaborate commission communication communications companies company compliance comply conclusion conduct confidential contain content controls counsel craft crafting crisis criteria critical cultivate culture cyber cybersecurity data day days deadline decision define defined demands describe details determination determine determined determining develop disclose disclosure disclosures documented does downtime drills during effective effectively effectiveness employees empowering encourage enforced engage engaged enhance enough ensure enterprise evaluated event everyone evolving exchange executives exercises exercises: existing experts external filled financial focusing following forwarding foster four framework gaps getting governance has have help helps here how identification identify identifying immediate impact impact: implications incident incidents include including incorporate incorporated industry information informed introduced involve its know leadership least leaving legal lessen level making management material materiality mature may meeting minimize mitigate mitigation monitor monitoring more nature necessary need needed new notification notification: notifications occurrences often one operational organization organize other outlines outlining oversee oversight parties party plan plan: planning plans policies posture potential pre preparedness prioritizes proactive procedure procedures process processes program promptly proposed protect protection protocols public publicly qualify questions questions: quickly readiness ready real recognized recordkeeping recovery regular regularly regulations related relevant report reporting reputational requirement requirements requires respond response responsibilities responsible results reviews revisit right risk risks robust roles room rule rules seamlessly sec securities security sensitive sharpen should simulate skills some specific specifications stay step steps strategy strong structured swiftly tabletop take taking team templates them these third thorough thoroughly threat threats throughout tight tips: top transparency transparent unexpected unprepared update updated user vulnerabilities vulnerability well what wide will within without world written you your yourself |
| Tags | Vulnerability Threat |
| Stories | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.