If you are an information professional at a publicly traded company, I would strongly suggest reading a recent blog post by Richard Bejtlich about the SEC’s requirements for the disclosure of cybersecurity breaches. Bejtlich points out that the ramifications of these requirements go well past getting in to hot water with the regulators – they also raise other risks, such as whistleblowing by employees or third parties as well as the potential for shareholder lawsuits when companies do not take the proper steps to secure information (or are perceived as not doing so). Having a conversation about this issue with your General Counsel before an incident occurs makes a lot of sense. All this being said, kudos to the SEC for recognizing the role of cybersecurity in good corporate governance.
RSS - Posts