kpmg.com SEC doubles down on cyber risk management accountability Four ways to avoid gambling with cyber risk disclosure A secure cyber environment is critical to modern business success. For too long, many leaders have viewed cybersecurity risks like reminders from the doctor to eat right and exercise—wise to do if you don’t want to gamble with your health. Much like a caution for better diet and exercise, cyber risk rarely becomes real until someone has a heart attack. Investors have been feeling chest pains over cyber risk, which is why the US Securities and Exchange Commission (SEC) has “clarified” regulations with sweeping new rules, forcing companies to better manage cyber risk and require specific actions regarding timeliness, consistency, and quality of incident response. Recent headlines highlight cyber incidents that are costing companies millions beyond that of information loss. Loss in reputation and supply chain interruption certainly hit heavy as well. For example, of the many incidents that have led the SEC to update these rules, one in particular drove a company’s stock price down more than 22 percent.1 The SEC now seeks to add protection that can help average investors know which of their business investments take cyber risk seriously. Before the new ruling, financial evaluation driven by actual loss and stock value impact determined materiality. Now, even if a company does not lose a dollar, an incident can be material. The more public an incident becomes, the more material it is. Companies, therefore, must assess cyber risks using qualitative and quantitative factors to determine the material impact on the company’s operations, customers, shareholders, and reputation.2 Highlights of the recent US SEC mandate Registrations must: Disclose any cybersecurity incident they determine to be material within four business days (with few exceptions) Describe processes for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material or the likely material effects or risks from cybersecurity threats and previous cybersecurity incidents – Includes the board of directors’ oversight of risks from cybersecurity threats Furnish FPI information with newly-qualified material details 2SEC doubles down on cyber risk management accountability © 2024 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved. USCS010661 -1A 1 Source: Rob Sloan, Wall Street Journal, “What The Board Needs to Know: Cyber Attack Costs,” October 9, 2023. 2 Ibid. Companies that rely on old processes are gambling with cyber risk. A broad range of stakeholders, from CISO organizations and board members to finance, general counsel, enterprise risk, and investor relations groups, all now need to understand how public companies manage their cyber risk. KPMG LLP and ServiceNow offer insight to help managing the qualitative and quantitative perils buried in regulation details. KPMG and ServiceNow bring a distinct approach to this topic as a collective that understands cybersecurity as both a technology problem and a business priority. ServiceNow brings a technology perspective with a cybersecurity and enterprise-risk management platform that includes purpose-built cyber risk, incident response, and reporting workflows. Combine that with the strategic implementation experience of KPMG, and you have here tangible and actionable advice to get you through this unprecedented time. Form 6-K 20-F Form 10-K Form 8-K The ante is in: Signals to act now We believe the SEC does not view these laws as new. The requirements read like clarifications to existing company responsibilities (i.e., to tell their shareholders about cyber risks, how the company manages them, and notification requirements when cyber incidents occur). The new guidance also hints toward more personal accountability (read: fines) for company executives.3 Most CFOs and general counsel do not share the same skill sets with CISOs, which could be a reason behind some of these changes, ensuring the two worlds coordinate better. Cyber risk management is now an equal partner to enterprise risk management rather than a line item, so the two sets of processes now must be integrated. 3SEC doubles down on cyber risk management accountability © 2024 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved. USCS010661 -1A New regulations require companies to: 1. Report how they manage cyber risk 2. Have a process to measure whether a cyber incident can impact materiality 3. Promptly report material incidents 4. Be transparent ... in their very next SEC annual reporting. personally identifiable information protected health information losses, plant shutdown, supply chain interruption, critical IP losses, revenue losses, incidents that threaten reputation, incidents that harm vendor or customer relationships, incidents that impact competitiveness, possible litigation, regulatory investigation, Four tips to help build a strong hand to meet regulation basics Before we can discuss tips and tricks, it’s important to emphasize the foundation of a documented cyber risk management strategy. It is critical considering the global average cost of a data breach is estimated at $4.45 million but (now) could be significantly higher depending on an attack’s impact plus SEC fines.4 Companies need a solid process to determine materiality and quickly fast-track what might be material to senior leaders who will determine if public notice is required. The goal is to ensure that your cyber risk processes are built into your IT and asset management processes, supported with dynamic reporting around asset status, with automation for risk triggers. This connects cyber risk with enterprise risk, by providing a platform for effective incident response. It allows for scalable compliance monitoring and provides a documented basis for the 10-K. With that emphasized, here are four tips in fortifying a solid foundation for SEC compliance. Types* of cyber incidents that could trigger a materiality review: personally identifiable information or protected health information losses, plant shutdown, supply chain interruption, critical IP losses, revenue losses, incidents that threaten reputation, incidents that harm vendor or customer relationships, incidents that impact competitiveness, incidents that cause litigation, regulatory investigation, and headline news coverage 3 Source: US Security and Exchange Commission, "Press Release: SEC Charges Chief Information Officer with Fraud," October 30, 2023. 4 Source: Verizon, “Ransomware threat rises: Verizon 2022 Data Breach Investigations Report,” May 24, 2022. *list not exhaustive 4SEC doubles down on cyber risk management accountability © 2024 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved. USCS010661 -1A Inventory Outline and document Draft Cyber risk management program Regulation S-K Item 106(b) Describe the practices employed for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents. Regulation S-K Item 106(b) Outline the assessors consultants, auditors, or third parties that support such processes. Regulation S-K Item 106(c) Include details on the oversight, authority, and frequency of cyber risk discussions. Regulation S-K Item 106(b) Describe the different types of cybersecurity risks, such as potential breaches, technological disruptions, and regulatory noncompliance. Regulation S-K Item 106(b) Explain strategy for handling cybersecurity risks and how these risks are managed within the ERM or Cyber risk management framework. Regulation S-K Item 106(b) Discuss the potential impacts on finances, reputation, and operations, along with the likelihood and severity of these risks. Regulation S-K Item 106(c) Describe the role of the board and C-suite in the cybersecurity processes. 10K 1. Be accurate in the 10-K With this regulation, public companies must now describe their cyber risk management practices in annual 10-K reports. Requirements include how companies evaluate, mitigate, and monitor cyber risks as well as how they allocate resources and assign responsibility for cybersecurity governance. To meet these reporting requirements, companies must map out and document current practices. The risk is not in writing the disclosure, it’s in the information accuracy required to pass an SEC audit. While the disclosure requirements are broader than described here, these parts of the new Item 106 in the Regulation S-K will require detailed information gathering and documentation. Working with a cybersecurity specialist to outline and document your cyber risk management program in the 10-K (as illustrated) can help improve accuracy and help close gaps. Sample cyber risk management program • Describe the key initiatives or investments taken to bolster cybersecurity • Outline procedures for recognizing, safeguarding, identifying, responding to, and recuperating from incidents • Detail cybersecurity risks, including potential breaches, technological disruptions, and regulatory compliance concerns • Explain the approach to managing cybersecurity risks and how they are approached • List the potential effects on finances, operations, and reputation—in probability and magnitude • Describe the involvement of the board and executive leadership in these procedural decisions 5SEC doubles down on cyber risk management accountability © 2024 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee.