Cybersecurity Act

Check a box or measure results

In April, the a blog titled “What CISOs Need to Know about the Proposed Cybersecurity Disclosure Act” was published by RiskLens. The recent Equifax incident reminds us that corporations need to assure stockholders of the adequacy of their protections for sensitive information. I sent the following analysis of the act and recommendations to the sponsoring senators, also informing Senator Maria Cantwell of Washington.

S. 536 IN THE SENATE OF THE UNITED STATES MARCH 7, 2017: To promote transparency in the oversight of cybersecurity risks at publicly traded companies.

Requirement

…issue rules to require each reporting company, in the annual report submitted under 12 section 13 or section 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m and 78o(d)) or the annual proxy 14 statement submitted under section 14(a) of such Act (15 15 U.S.C. 78n(a))—

  • To disclose whether any member of the governing body, such as the board of directors or general partner, of the reporting company has expertise or experience in cybersecurity and in such detail as necessary to fully describe the nature of the expertise or experience; and
  • If no member of the governing body of the reporting company has expertise or experience in cybersecurity, to describe what other cybersecurity steps taken by the reporting company were taken into account by such persons responsible for identifying and evaluating nominees for any member of the governing body, such as a nominating committee.

Observation

The Bill is a worthwhile endeavor to improve transparency on cybersecurity security risk in publicly traded companies.

The Securities Exchange Act of 1934 identifies many responsibilities associated with governance, but no expectation of specific expertise or experience. This new requirement could conceivable stimulate proposals to add other expertise such as legal, financial, engineering, software development, and so forth. A course of action is prescribed in hopes that improved transparency of cybersecurity risk results.

The desired outcome in the Bill’s title, “…transparency in the oversight of cybersecurity risks…”, suggests that transparency of risks is the desired outcome. However, the bill fails to define how transparency of risks is to be achieved, and lacks a definition of the term “risk.” The lack of consensus among the security community on a definition of risk provides further mystery as to the desired outcome.

Recommendation

Rewrite the Bill to enhance existing transparency requirements for publicly traded companies. A draft is provided below:

Section 1.A Risk Factors of the Form 10-K requires that the registrant “Provide any discussion of risk factors in plain English…”.  Many organization provide a title and narrative of risks that may fit in the definition of “cybersecurity.” However, the reader is not informed of the financial significance of the risk, resulting in less than transparency.

The revised Bill should define risk as probable magnitude of annual loss, and should revise Section 1.A Risk Factors of the Form 10-K to include the probable magnitude of annual loss when reporting cybersecurity risk. This would provide the desired improvement in transparency.

The FAIR Institute (http://www.fairinstitute.org/) and The Open Group – Security Forum (http://www.opengroup.org ) are available to assist NIST with terminology and risk analysis methodology.

FORM 10-K: ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 –  GENERAL INSTRUCTIONS

Relevance

  1. Rule as to Use of Form 10-K.

(1) This Form shall be used for annual reports pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)) (the “Act”) for which no other form is prescribed.

Relevant Requirement

Item 1A. Risk Factors. Set forth, under the caption “Risk Factors,” where appropriate, the risk factors described in Item 503(c) of Regulation S-K (§229.503(c) of this chapter) applicable to the registrant. Provide any discussion of risk factors in plain English in accordance with Rule 421(d) of the Securities Act of 1933 (§230.421(d) of this chapter). Smaller reporting companies are not required to provide the information required by this item.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s