Security Management Strategies for the CIOAccess "SEC guidance clarifies cybersecurity disclosure requirements"
This article is part of the December 2011 issue of An insider look at the Windows Vista security review
Recent guidance from the U.S. Securities and Exchange Commission on disclosure of cybersecurity risks and incidents puts the spotlight squarely on enterprise cybersecurity and could help security professionals at publicly traded companies win funding for projects, experts say. Released in October, the guidance from the SEC’s Division of Corporate Finance makes it clear that companies must factor cybersecurity risks and incidents into their SEC disclosures. Companies should disclose “the risk of cyber incidents if these issues are among the most significant factors that make an investment in the company speculative or risky,” according to the guidelines. In order to determine whether disclosure is required, the SEC says companies should take into account a number of factors, including prior incidents, the potential costs and consequences of data theft or operational disruption resulting from a breach, and the adequacy of preventative actions to reduce risk. The SEC advises companies to avoid generic “boilerplate” disclosure, but notes that detailed ... Access >>>
Access TechTarget
Premium Content for Free.
What's Inside
Features
-
-
SEC guidance clarifies cybersecurity disclosure requirements
by Marcia Savage, Editor
Companies need to factor security risks and incidents in their financial disclosures, agency says.
-
Enterprise digital rights management best practices
by Rich Mogull
EDRM brings users into security more than any other tool. Are you ready?
-
SEC guidance clarifies cybersecurity disclosure requirements
by Marcia Savage, Editor
-
-
Alternatives to passwords: Replacing the ubiquitous authenticator
by Ron Condon, UK Bureau Chief
As the relative security of passwords falters, are they destined for obscurity?
-
Chris Paget on Vista final software security review
by Chris Paget, Contributor
Researcher tells a firsthand account of her experience as a member of the final security review team for Windows Vista.
-
Alternatives to passwords: Replacing the ubiquitous authenticator
by Ron Condon, UK Bureau Chief
-
Columns
-
The ongoing debate over a federal breach notification law
by Marcia Savage, Editor
Lawmakers continue to wrangle over creation of a national data breach notification standard.
-
Good information security leaders must be good security recruiters
by Lee Kushner and Mike Murray
If you’re going to lure topnotch talent, refine your skills.
-
The need for cloud computing security standards
by Amy Larsen DeCarlo, Contributor
Cloud computing needs security standards and widely adopted security practices in order to become a viable choice for the enterprise.
-
The ongoing debate over a federal breach notification law
by Marcia Savage, Editor
More Premium Content Accessible For Free
Compliance and risk modeling
E-Zine
You can fight compliance or embrace it, but one way or the other, you can’t escape it. Increasingly, smart organizations are not just accepting ...
Essentials: Threat detection
E-Zine
Antivirus and intrusion prevention aren’t the threat detection stalwarts they used to be. With mobile endpoints and new attack dynamics, enterprises ...
Managing identities in hybrid worlds
E-Zine
The world in which successful IAM programs must be implemented is increasingly complex, a mix of legacy on-premise IAM infrastructures, cloud-based ...