Data breaches have become a significant concern for organizations, with cyber incidents posing serious risks to businesses and their customers. To address these concerns, the Securities and Exchange Commission (SEC) has adopted new rules that require organizations to disclose material cybersecurity incidents and provide information on their risk management, strategy, and governance. Compliance with these rules is essential for public companies and foreign issuers to protect investors and maintain transparency. In this article, we will explore the steps organizations should take to comply with the SEC’s new data breach notification rule.

Secure Your Systems and Fix Vulnerabilities

The first step in complying with the SEC’s new data breach notification rule is to secure your systems and fix any vulnerabilities that may have caused the breach. Move quickly to address any security issues to prevent further incidents. Secure physical areas potentially related to the breach by locking them and changing access codes if necessary. Consult with experts in data forensics and legal counsel to determine the source and scope of the breach and outline remediation steps. Stop additional data loss by taking affected equipment offline immediately and closely monitoring entry and exit points. Remove improperly posted information from your website and other websites.

Mobilize Your Breach Response Team

To effectively respond to a data breach, assemble a team of experts from various departments within your organization. This team may include individuals from forensics, legal, information security, information technology, operations, human resources, communications, investor relations, and management. Identify a data forensics team, consider hiring independent forensic investigators to help determine the source and scope of the breach. Consult with legal counsel, both internal and external, to ensure compliance with federal and state laws. Mobilize your breach response team promptly to prevent additional data loss and coordinate the investigation and remediation efforts.

Conduct a Comprehensive Breach Investigation

Interview individuals who discovered the breach and gather information from anyone else who may have knowledge about the incident. Document your investigation thoroughly and avoid destroying any forensic evidence. Work with your forensics experts to analyze backup or preserved data, review logs to determine who had access to the data, and assess the current access permissions. Restrict access to authorized users by updating credentials and passwords. Determine the types of information compromised, the number of people affected, and whether you have contact information for those individuals. Take recommended remedial measures based on the findings of your investigation and forensic reports.

Develop a Communications Plan

Creating a comprehensive communications plan is crucial to effectively manage a data breach. The plan should reach all affected audiences, including employees, customers, investors, business partners, and other stakeholders. Ensure that your communications are transparent, accurate, and provide necessary information to help individuals protect themselves and their information. Anticipate the questions that people may ask and provide clear, plain-language answers on your website and other communication channels. Good communication upfront can help alleviate concerns and minimize the impact of the breach on your organization’s reputation.

Comply with Legal Requirements and Notify Appropriate Parties

Determine your legal requirements by reviewing state and federal laws or regulations pertaining to breach notification. Notify law enforcement immediately by contacting your local police department or the appropriate federal agencies. If the breach involves electronic personal health records, comply with the Health Breach Notification Rule and the HIPAA Breach Notification Rule, if applicable. Notify affected businesses, such as financial institutions or service providers, if account access information has been compromised. Follow the prescribed timelines and methods for providing notifications to affected individuals, law enforcement, and other relevant parties.

Enhance Risk Management and Governance Practices

As part of compliance with the SEC’s new data breach notification rule, organizations must enhance their risk management and governance practices related to cybersecurity. Develop and maintain active processes for assessing, identifying, and managing material risks from cybersecurity threats. Implement measures for cyber incident prevention, detection, and mitigation. Establish business continuity and recovery procedures to ensure a timely response in the event of a breach. Describe the board of directors’ oversight of cybersecurity risks and management’s role and expertise in assessing and managing material cyber risk. Engage with third-party assessors or consultants to validate and improve your cybersecurity practices.

Maintain Compliance with Reporting and Disclosure Requirements

Public companies and foreign issuers must adhere to reporting and disclosure requirements outlined in the SEC’s new rule. Promptly file Form 8-K or Form 6-K within the specified timeline after determining a material incident has occurred. Include detailed information about the nature, scope, timing, and impact of the breach in the disclosure. Periodically disclose cybersecurity risk management, strategy, and governance in annual reports on Form 10-K or Form 20-F. Describe your cybersecurity risk program, engagement with third-party assessors, incident prevention measures, business continuity procedures, and the potential impact of cybersecurity risks on your organization’s financials. Ensure compliance with structured data requirements by tagging disclosures in Inline XBRL.

Collaborate Across Departments and with External Experts

Compliance with the SEC’s new data breach notification rule requires collaboration across various departments and engagement with external experts. Establish clear lines of communication between the security team, legal, finance, investor relations, and other relevant stakeholders. Create a disclosure committee responsible for gathering and disseminating information related to the breach. Work closely with your board of directors to enhance cybersecurity oversight and consider appointing cybersecurity experts to the board. Engage external legal counsel and forensic investigators to support your breach response efforts and ensure compliance with legal requirements.

Stay Updated on Evolving Cybersecurity Threats

Cybersecurity threats are constantly evolving, and organizations must stay informed about the latest risks and trends. Regularly assess and update your cybersecurity measures to address emerging threats. Conduct tabletop exercises and simulations to test your incident response plans and identify areas for improvement. Provide ongoing training to employees to raise awareness about cybersecurity best practices and how to report suspected breaches. Stay informed about regulatory changes and industry standards to ensure ongoing compliance and adapt your cybersecurity practices accordingly.

Leverage Technology Solutions for Detection and Response

Implementing technology solutions can enhance your organization’s ability to detect, respond to, and mitigate cybersecurity incidents. Invest in advanced security tools that provide real-time monitoring, threat intelligence, and automated incident response capabilities. Leverage artificial intelligence and machine learning to identify patterns and detect anomalies in network traffic or user behavior. Implement robust data loss prevention measures to safeguard sensitive information. Regularly test and update your security systems to ensure their effectiveness against evolving threats.

Compliance

Complying with the SEC’s new data breach notification rule is crucial for organizations to protect investors, maintain transparency, and effectively manage cybersecurity risks. By following the steps outlined in this article, organizations can enhance their security posture, strengthen incident response capabilities, and establish robust risk management and governance practices. Collaboration across departments, engagement with external experts, and leveraging technology solutions are key to achieving compliance and mitigating the impact of data breaches. Stay vigilant, continuously improve your cybersecurity measures, and prioritize the protection of sensitive information to safeguard your organization and its stakeholders.

Jonathan Wilcheck
Vendor Management Expert
Subject Matter Expert