SEC Cybersecurity Disclosure Rules: 9 Questions to Ask Third Parties Now

1) Has the organization established a formal cybersecurity incident management process?

Please select one of the following:

a) Yes, a formal cybersecurity incident management process has been developed.

b) No, a formal cybersecurity incident management process has not been developed.

2) Would the organization disclose the following information about a material cybersecurity incident?

Please select all that apply.

a) When the incident was discovered and whether it is ongoing.

b) A brief description of the nature and scope of the incident.

c) Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose.

d) The effect of the incident on the registrant’s operations.

e) Whether the registrant has remediated or is currently remediating the incident.

3) Following identification of a cybersecurity incident, is the material impact and potential impact on operations and financial condition recorded and disclosed?

Please select one of the following:

a) Yes, both material and potential impact to operational and financial conditions are recorded.

b) No, impact to operational and financial conditions are not recorded or disclosed.

4) Do disclosures of cybersecurity incidents include remediation actions taken, and where changes to policy or procedure have been made as a result of these incidents?

Help text: Any changes in the registrant’s policies and procedures as a result of a cybersecurity incident should be recorded.

Please select one of the following:

a) Yes, remediation actions are taken, and changes to policy or procedures are disclosed.

b) No, remediation actions are not taken, and changes to policy or procedures are not disclosed.

5) Does the organization have a cybersecurity risk assessment program?

Please select one of the following:

a) Yes, a cybersecurity risk assessment program has been developed.

b) No, a cybersecurity risk assessment program has not been developed.

6) Has the organization established any policies and procedures to oversee and identify the cybersecurity risks associated with its use of third-party service providers?

Please select all that apply.

a) A set of policies and procedures for managing risks associated with third-party service providers is established.

b) Results of risk assessments support the decision for the selection and oversight of third-party service providers.

c) Risks associated with the use of third-party service providers are actioned, and security and privacy controls are defined within third-party contracts.

7) Do the results of cybersecurity risk assessments factor into decisions regarding governance policies and procedures, technologies and business strategies?

Please select one of the following:

a) Yes, the results of cybersecurity risk assessments are considered when reviewing governance policies and procedures, technologies and business strategies.

b) No, results of cybersecurity risk assessments are not considered when reviewing governance policies and procedures, technologies and business strategies.

8) Does the organization's management, board or designated committee have responsibility for the oversight of cybersecurity risks?

Please select one of the following:

a) Yes, management, the board or a designated committee has responsibility for cybersecurity risks.

b) No designated group or committee has overall responsibility for cybersecurity risks.

9) Please state how the board and management receive information regarding cybersecurity risks.

Please select all that apply.

a) The board and management receive notifications about cybersecurity risks on a frequent basis.

b) Cybersecurity risks are considered as part of business strategy, risk management and financial oversight planning.