New Report: The 2022 Gartner® Market Guide for IT Vendor Risk Management Solutions

SEC Cybersecurity Disclosure Rules: 10 Questions to Ask Third Parties Now

Prepare for updated SEC requirements by asking your vendors and suppliers about their cybersecurity risk management, governance and incident disclosure processes.
By:
Thomas Humphreys
,
Prevalent Compliance Expert
November 16, 2022
Share:
Blog sec cybersecurity disclosure 1122

In March 2022 the U.S. Securities and Exchange Commission (SEC) proposed new rules and amendments to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance and incident reporting by public companies. The SEC publication notes that cybersecurity risks have recently been escalating for a variety of reasons, including companies’ increasing reliance on third-party service providers for IT services and a growing number of incidents traced to service providers.

Although the SEC has not yet announced a date for when the changes will be finalized and enforced, there are several actions you can take now to prepare – including assessing vendor and suppliers' policies for cybersecurity incident management.

Prepare for the Updated SEC Cybersecurity Disclosure Rules with this Third-Party Assessment

To help public companies prepare for the new reporting requirements, Prevalent has created a 10-question assessment for the security and risk management community. Use the assessment to:

  • Determine the extent of third-party cybersecurity incident management processes (e.g., business continuity, contingency and recovery plans)
  • Identify how third parties report on the operational impacts of cyber incidents
  • Examine third-party cybersecurity risk assessment and risk identification programs
  • Clarify remediation actions taken as part of cybersecurity incident response
  • Reveal the level of board and CISO oversight into third-party cybersecurity incidents
Questions Answer Choices

1) Has the organization established a formal cybersecurity incident management process?

Please select one of the following:

a) Yes, a formal cybersecurity incident management process has been developed.

b) No, a formal cybersecurity incident management process has not been developed.

2) Would the organization disclose the following information about a material cybersecurity incident?

Please select all that apply.

a) When the incident was discovered and whether it is ongoing.

b) A brief description of the nature and scope of the incident.

c) Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose.

d) The effect of the incident on the registrant’s operations.

e) Whether the registrant has remediated or is currently remediating the incident.

3) Following identification of a cybersecurity incident, is the material impact and potential impact on operations and financial condition recorded and disclosed?

Please select one of the following:

a) Yes, both material and potential impact to operational and financial conditions are recorded.

b) No, impact to operational and financial conditions are not recorded or disclosed.

4) Do disclosures of cybersecurity incidents include remediation actions taken, and where changes to policy or procedure have been made as a result of these incidents?

Help text: Any changes in the registrant’s policies and procedures as a result of a cybersecurity incident should be recorded.

Please select one of the following:

a) Yes, remediation actions are taken, and changes to policy or procedures are disclosed.

b) No, remediation actions are not taken, and changes to policy or procedures are not disclosed.

5) Does the organization have a cybersecurity risk assessment program?

Please select one of the following:

a) Yes, a cybersecurity risk assessment program has been developed.

b) No, a cybersecurity risk assessment program has not been developed.

6) Has the organization established any policies and procedures to oversee and identify the cybersecurity risks associated with its use of third-party service providers?

Please select all that apply.

a) A set of policies and procedures for managing risks associated with third-party service providers is established.

b) Results of risk assessments support the decision for the selection and oversight of third-party service providers.

c) Risks associated with the use of third-party service providers are actioned, and security and privacy controls are defined within third-party contracts.

7) Have business continuity, contingency and recovery plans been developed?

Please select one of the following:

a) Yes, business continuity, contingency and recovery plans have been developed.

b) No, business continuity, contingency and recovery plans have not been developed.

8) Do the results of cybersecurity risk assessments factor into decisions regarding governance policies and procedures, technologies and business strategies?

Please select one of the following:

a) Yes, the results of cybersecurity risk assessments are considered when reviewing governance policies and procedures, technologies and business strategies.

b) No, results of cybersecurity risk assessments are not considered when reviewing governance policies and procedures, technologies and business strategies.

9) Does the organization's board or designated committee have responsibility for the oversight of cybersecurity risks?

Please select one of the following:

a) Yes, the board or a designated committee has responsibility for cybersecurity risks.

b) No designated group or committee with overall responsibility for cybersecurity risks.

10) Please state how the board receives information regarding cybersecurity risks.

Please select all that apply.

a) The board receives notifications about cybersecurity risks on a frequent basis.

b) Cybersecurity risks are considered as part of business strategy, risk management and financial oversight planning.

c) A designated chief information security officer (CISO) role exists to monitor and report on cybersecurity risks and incidents.

Prepare Now for Proposed SEC Cybersecurity Disclosure Rules

This guide is ideal for any security, compliance or risk management professional who needs to prepare their organization to meet upcoming SEC requirements.

Read Now
Feature sec cybersecurity checklist

Best Practices for Third-Party Cybersecurity Risk Management, Governance, Strategy and Incident Disclosure

A well-governed third-party risk management program includes processes and technology that supports identifying, triaging, and remediating risks across the third-party lifecycle. Here are several best practices to consider as you evaluate your third-party governance program:

Next Steps: Download the SEC Cybersecurity Disclosure Rules Checklist

For more on how Prevalent can help your organization prepare for the forthcoming SEC rules, download our SEC Cybersecurity Disclosure Rules checklist. Or, contact us to schedule a demo today.

Tags:
Share:
Thomas humphreys
Thomas Humphreys
Prevalent Compliance Expert
  • Ready to get started?
  • Schedule a personalized solution demonstration to see if Prevalent is a fit for you.
  • Request a Demo