Ready, Set, Respond: Ensuring Compliance with the SEC Reporting Regulations

Originally published by Mitiga.

Written by Ariel Parnes.

The Securities and Exchange Commission (SEC) of the United States has adopted new regulations that require public companies to disclose material cybersecurity incidents within four days. To the positive, this initiative seeks to increase transparency and safeguard investors against potential cybersecurity risks. However, it also puts new weight and responsibility on enterprises that may not yet be ready for the challenge. Meeting this stringent 4-day standard means that enterprises now must be able to investigate cyberattacks swiftly and precisely to determine the significance of incidents. This was more feasible when incidents primarily impacted on-premises environments. Now that the threat landscape extends across multi-cloud and SaaS environments, there is an added measure of complexity in meeting the expectation.

What the SEC Ruling Means for Enterprises IR (Incident Response)

Companies must promptly evaluate the severity of a data breach to determine if it is "material" and requires immediate disclosure. This requires addressing three fundamental concerns regarding the occurrence:

1. What access did the attacker gain? It is crucial to quickly determine the extent of an attacker's access to an organization's systems. Enterprises must determine whether the intruder obtained unauthorized access, deeply penetrated critical infrastructure, or merely scratched the surface.

2. What data was compromised? Understanding the scope of data compromised during a cyber attack is crucial for assessing the enterprise’s potential risks and impact on its stakeholders. Identifying sensitive data that may have been compromised can aid in the formulation of an appropriate response.

3. Where did the attack originate? Determining the attack vector, i.e., the method used by the perpetrator to infiltrate the organization's network, is essential for assessing the sophistication level and potential risk. This data can inform future security measures and aid in the prevention of similar assaults.

Developing New Capabilities for Rapid Breach Investigations

To meet the SEC's stricter reporting deadlines, enterprises will not only require new organizational focus but also need to be enabled with the latest incident response capabilities. For example, enterprises must seek solutions that cover them across all their cloud and SaaS environments, offer greater degrees of visibility and breach readiness, and can analyze the forensic data collected to provide swift answers. Because traditional incident response methods routinely require weeks and months to collect data following a breach, it becomes clear how vital innovative approaches are.