Latest Report: The 2022 Gartner® Market Guide for IT Vendor Risk Management Solutions
In March 2022 the U.S. Securities and Exchange Commission (SEC) proposed new rules and amendments to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance and incident reporting by public companies. The SEC publication notes that cybersecurity risks have recently been escalating for a variety of reasons, including companies’ increasing reliance on third-party service providers for IT services and a growing number of incidents traced to service providers.
Although the SEC has not yet announced a date for when the changes will be finalized and enforced, there are several actions you can take now to prepare – including assessing vendor and suppliers' policies for cybersecurity incident management.
To help public companies prepare for the new reporting requirements, Prevalent has created a 10-question assessment for the security and risk management community. Use the assessment to:
Questions | Answer Choices |
---|---|
1) Has the organization established a formal cybersecurity incident management process? |
Please select one of the following: a) Yes, a formal cybersecurity incident management process has been developed. b) No, a formal cybersecurity incident management process has not been developed. |
2) Would the organization disclose the following information about a material cybersecurity incident? |
Please select all that apply. a) When the incident was discovered and whether it is ongoing. b) A brief description of the nature and scope of the incident. c) Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose. d) The effect of the incident on the registrant’s operations. e) Whether the registrant has remediated or is currently remediating the incident. |
3) Following identification of a cybersecurity incident, is the material impact and potential impact on operations and financial condition recorded and disclosed? |
Please select one of the following: a) Yes, both material and potential impact to operational and financial conditions are recorded. b) No, impact to operational and financial conditions are not recorded or disclosed. |
4) Do disclosures of cybersecurity incidents include remediation actions taken, and where changes to policy or procedure have been made as a result of these incidents? Help text: Any changes in the registrant’s policies and procedures as a result of a cybersecurity incident should be recorded. |
Please select one of the following: a) Yes, remediation actions are taken, and changes to policy or procedures are disclosed. b) No, remediation actions are not taken, and changes to policy or procedures are not disclosed. |
5) Does the organization have a cybersecurity risk assessment program? |
Please select one of the following: a) Yes, a cybersecurity risk assessment program has been developed. b) No, a cybersecurity risk assessment program has not been developed. |
6) Has the organization established any policies and procedures to oversee and identify the cybersecurity risks associated with its use of third-party service providers? |
Please select all that apply. a) A set of policies and procedures for managing risks associated with third-party service providers is established. b) Results of risk assessments support the decision for the selection and oversight of third-party service providers. c) Risks associated with the use of third-party service providers are actioned, and security and privacy controls are defined within third-party contracts. |
7) Have business continuity, contingency and recovery plans been developed? |
Please select one of the following: a) Yes, business continuity, contingency and recovery plans have been developed. b) No, business continuity, contingency and recovery plans have not been developed. |
8) Do the results of cybersecurity risk assessments factor into decisions regarding governance policies and procedures, technologies and business strategies? |
Please select one of the following: a) Yes, the results of cybersecurity risk assessments are considered when reviewing governance policies and procedures, technologies and business strategies. b) No, results of cybersecurity risk assessments are not considered when reviewing governance policies and procedures, technologies and business strategies. |
9) Does the organization's board or designated committee have responsibility for the oversight of cybersecurity risks? |
Please select one of the following: a) Yes, the board or a designated committee has responsibility for cybersecurity risks. b) No designated group or committee with overall responsibility for cybersecurity risks. |
10) Please state how the board receives information regarding cybersecurity risks. |
Please select all that apply. a) The board receives notifications about cybersecurity risks on a frequent basis. b) Cybersecurity risks are considered as part of business strategy, risk management and financial oversight planning. c) A designated chief information security officer (CISO) role exists to monitor and report on cybersecurity risks and incidents. |
Prepare Now for Proposed SEC Cybersecurity Disclosure Rules
This guide is ideal for any security, compliance or risk management professional who needs to prepare their organization to meet upcoming SEC requirements.
A well-governed third-party risk management program includes processes and technology that supports identifying, triaging, and remediating risks across the third-party lifecycle. Here are several best practices to consider as you evaluate your third-party governance program:
For more on how Prevalent can help your organization prepare for the forthcoming SEC rules, download our SEC Cybersecurity Disclosure Rules checklist. Or, contact us to schedule a demo today.
Prevalent offers a complete framework for policy management, auditing and reporting related to third-party risk and...
03/21/2023
Here are best practices for aligning with proposed requirements from the U.S. Federal Reserve System, U.S...
03/08/2023
MAS has established detailed requirements for managing third-party outsourcing and non-outsourcing relationships. Read how you can...
03/06/2023