The SEC's new cybersecurity regulations went into effect last week. Most companies are "largely ready" to comply, Matt Gorham, senior managing director and leader of PwC's Cyber & Privacy InnovationInstitute, told CFO Brew, "but that doesn't mean there isn't work to do."
As their companies' finance leaders, CFOs are instrumental in determining whether a cybersecurity incident is material, but they have other roles to play as well. Gorham shared his advice for how CFOs can help their organizations comply with the new regs. Now, aAs a reminder, the regulations consist of what Gorham refers to as three "buckets." Companies that file with the SEC are required to:
Declare any material cybersecurity incidents to the SEC on Item 1.05 of Form 8-K within four business days of determining materiality
Disclose information about their cyber risk management and strategy on a new section of the 10-K called Item 1C
Disclose information about their boards' and management's role in overseeing cybersecurity risk
The first two "buckets," Gorham said, will likely require the most work to comply with.
No comments:
Post a Comment