Get Visibility and Control Over Your Data

Origin of the SEC Cybersecurity Disclosure Rule

The SEC Cybersecurity Disclosure Rule didn't emerge in a vacuum. Its existence is a testament to the increasing prevalence of cyber threats in the financial sector.

Historically, public companies in the United States had no obligation to disclose cyber incidents, and this lack of transparency posed risks to investors and market integrity. The SEC Cybersecurity Disclosure Rule was introduced to address these concerns, working to protect investors and maintain fair markets by ensuring transparency around cyber incidents.

The rule applies to all public companies and requires them to disclose material cybersecurity risks and incidents promptly. A wide range of cyber incidents fall under the scope of this requirement, from data breaches to ransomware attacks.

The SEC's goal is to ensure that investors have the necessary information to make informed decisions. By requiring companies to disclose cyber incidents, the SEC seeks to promote transparency and accountability in the public sector.

Key Requirements for Public Companies

The SEC Cybersecurity Disclosure Rule imposes several key requirements on public companies.

• First, companies must disclose material cybersecurity risks and incidents in a timely manner. This includes both successful attacks and attempted breaches that could have a material impact on the company. The criteria for determining whether a cyber incident is “material” are left to the company's discretion. Factors to consider include the nature of the incident, its impact on operations or financial health and the potential harm to customers or business relationships.
• Second, companies are required to disclose their cybersecurity governance policies. This includes the role of the board of directors in overseeing these policies, highlighting the importance of leadership in managing cybersecurity risks. The rule also requires companies to review and update their cybersecurity strategies regularly.
• Finally, public companies must have incident response plans in place. These plans should be disclosed under the rule, highlighting the company's preparedness to handle cyber incidents.

Enforcement and Penalties for Non-Compliance

The SEC is responsible for enforcing the Cybersecurity Disclosure Rule, with the authority to investigate potential violations and impose sanctions. These sanctions can range from fines to the suspension or revocation of a company's securities registration.

It hardly needs to be stated that non-compliance can have serious negative ramifications beyond any punitive actions taken by the SEC. It can lead to reputational damage, loss of investor confidence and in severe cases, legal action from shareholders. Therefore, it is in the best interest of companies to comply with the rule and maintain transparency in their cybersecurity disclosures.

How Forcepoint Streamlines Cybersecurity Compliance

Forcepoint offers a range of security solutions to enhance the speed, ease and proper execution of compliance activities, with different options and combinations to meet varying organizational needs.

Used together, these provide unparalleled visibility and control over data on all channels employees interact with it. This approach, which we call “Data Security Everywhere,” simplifies data security compliance for sensitive data.

For cloud-first organizations, the most effective way to achieve Data Security Everywhere is by combining the proactive power of Data Security Posture Management (DSPM) with the reactive capabilities of Forcepoint ONE Data Security, our cloud-based Data Loss Prevention (DLP) tool. This pairs true visibility with granular control.

Forcepoint DLP solutions offer over 1,700 pre-defined policies, templates and classifiers – the largest such library in the industry – to provide out-of-the-box compliance for more than 150 regions. You can integrate Forcepoint DLP with your SIEM and add Risk-Adaptive Protection to monitor user risk through behavioral analysis and automatically detect and intervene in insider threats.

Using the Forcepoint ONE platform, security teams can deploy and adjust policies across cloud, web and private apps with just a few clicks. This includes a single incident reporting interface for all of your data, increasing your efficiency at reporting incidents and auditing for compliance.

See how Data Security Everywhere can take the guessing out of cybersecurity compliance. Learn more about Data Security Everywhere, or talk to an expert to set up a customized product demo.