Comment on the US SEC's proposed cybersecurity rules. CISA announced new members of its Advisory Board.

Summary

By the CyberWire staff

At a glance.

Comment on the US SEC's proposed cybersecurity rules.
CISA announced new members of its Advisory Board.

Comment on the US SEC's proposed cybersecurity rules.

Earlier this month the US Securities and Exchange Commission (SEC) proposed a set of rules involving cybersecurity risk management and reporting:

"First, it would require mandatory, ongoing disclosures on companies’ governance, risk management, and strategy with respect to cybersecurity risks. This would allow investors to assess these risks more effectively. For example, under the proposed rules, companies would disclose information such as:

"management’s and the board’s role and oversight of cybersecurity risks;
"whether companies have cybersecurity policies and procedures; and"
how cybersecurity risks and incidents are likely to impact the company’s financials.

"Second, it would require mandatory, material cybersecurity incident reporting. This is critical because such material cybersecurity incidents could affect investors’ decision-making.

"When companies have an obligation to disclose material information to investors, they must be complete and accurate. Their disclosures also should be timely. Today’s proposal would specify when and what information about cybersecurity incidents companies must disclose in a current report, such as on Form 8-K. It also would require updates in periodic reports to give investors more complete information on previously disclosed, material cybersecurity incidents."

The SEC has issued announcements covering three changes:

Security Week has a brief overview of the proposed rules' implications. Lowenstein Sandler encourages entities likely to be affected to review the proposed rules and offer public comment on them.

CISA announced new members of its Advisory Board.

The US Cybersecurity and Infrastructure Security Agency (CISA) has announced new members of its advisory board. They represent a mix of experience in the public and private sector. The new members are:

Dave DeWalt, CEO and Founder, NightDragon
Brian Gragnolati, President and CEO, Atlantic Health System
Royal Hansen, Vice President of Privacy, Safety and Security Engineering, Google
Chris Inglis, Former U.S. National Cyber Director
Rahul Jalali, Senior Vice President and Chief Information Officer, Union Pacific
John Katko, Former Representative for New York's 24th District
Jim Langevin, Former Representative for Rhode Island's 2nd District
Cathy Lanier, Senior Vice President and Chief Security Officer, National Football League
Doug Levin, Co-Founder and National Director, K12 Security Information eXchange (SIX)
Ciaran Martin, Former CEO, National Cyber Security Centre (United Kingdom)
Robert Scott, Commissioner, New Hampshire Department of Environmental Services
Kevin Tierney, Vice President and Chief Cybersecurity Officer, General Motors
Alex Tosheff, Senior Vice President and Chief Security Officer, VMware

Selected Reading

The Scorched-Earth Tactics of Iran’s Cyber Army (WIRED) Amid ongoing protests, the Iranian regime has lost control of its image, pushing it to employ increasingly drastic tactics where everyone loses.

Millions in Punjab still without mobile internet as shutdown extended to fourth day (Record) As Indian authorities search for the leader of a Sikh separatist movement, the mobile internet in the state of Punjab has been shut down.

European Ports Brace for Cybersecurity Regulation (Wall Street Journal) A law taking effect in 2024 will require hundreds of companies at ports and in critical sectors to comply with cybersecurity rules for the first time.

Data breaches are increasing at a rapid speed. Here’s what can be done (World Economic Forum) Cybersecurity discussions have had an acute focus on modes of attack, missing how individuals are impacted by data breaches and how they can be protected.

McKinsey behind govt's new cyber strategy (InnovationAus.com) Controversial global consulting giant McKinsey will have a key role in the development of Australia’s cybersecurity strategy, 18 months after the government was widely criticised for using the company to develop its net zero strategy. McKinsey will be paid nearly $1 million for less than two month’s support work on the new cyber strategy being developed by the Albanese government, with the contract set to end just weeks out from the May budget. The Department of Home Affairs awarded McKinsey a one-and-a-half month, $950,000 contract for “project management” early this month after approaching just two other suppliers put of more than 400 pre-approved suppliers.

SEC issues new cybersecurity requirements for risk management (Security Magazine) The SEC has issued new cybersecurity risk management requirements. The requirements will apply to sectors collectively labeled as Market Entities.

SEC Proposes Rash of New Rules on Cybersecurity (Privacy) | Lowenstein Sandler LLP (Lowenstein Sandler) In its efforts to address cybersecurity risks, the U.S. Securities and Exchange Commission (“SEC”) continues to propose rules on cybersecurity. Most recently, on March 15, 2023, the SEC announced its proposal of three cybersecurity measures intended to expand existing rules and create new ones. This announcement amplifies the business and legal communities’ anticipation of the SEC’s expected release of new rules in April 2023.

Director Easterly Announces New Members to Join CISA's Cybersecurity Advisory Committee (Cybersecurity and Infrastructure Security Agency) Today, the Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly announced the appointment of additional members to the CISA Cybersecurity Advisory Committee (CSAC), bringing onboard additional experts from the public and private sectors who will advise the Director on policies and initiatives to enhance the nation's cyber defense.

CISA Advisory Committee Adds Inglis, Katko, Langevin (Meritalk) Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly today announced the appointment of new members to the CISA Cybersecurity Advisory Committee (CSAC), who will help advise her on policies and initiatives to bolster the nation’s cybersecurity posture.