{"id":54191,"date":"2023-10-18T21:41:00","date_gmt":"2023-10-18T21:41:00","guid":{"rendered":"https:\/\/www.darkreading.com\/edge\/what-cisos-should-exclude-from-sec-cybersecurity-filings"},"modified":"2023-10-18T21:41:00","modified_gmt":"2023-10-18T21:41:00","slug":"what-cisos-should-exclude-from-sec-cybersecurity-filings","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/what-cisos-should-exclude-from-sec-cybersecurity-filings\/","title":{"rendered":"What CISOs Should Exclude From SEC Cybersecurity Filings"},"content":{"rendered":"
<\/div>\n

As enterprises continue to weigh which security incidents constitute something material enough to be reported under the new SEC rules<\/a>, CISOs face the challenge of deciding what details to report and, far more critically, which ones to omit.<\/p>\n

“This [SEC] rule puts CISOs in a very delicate position, and they are not<\/em> being given a lot of guidance or direction,” says Merritt Maxim, a Forrester VP and research director. “You know you’ve been compromised, but you don’t have all the facts on day one.”<\/p>\n

In the case of a material incident<\/a>, the CISO, along with the security operations center, would have to prepare a memo with all of the incident details and send it to investor relations and legal. Once those departments have reviewed it, the memo would be used to prepare the filing for the Securities and Exchange Commission.<\/p>\n

Although the new SEC rules take effect Dec. 18, there are already disclosures<\/a> from three enterprises that CISOs can look at to get an idea of how to comply with the new rules: Caesars<\/a>, MGM<\/a>, and two filings<\/a> from Clorox<\/a>.<\/p>\n

Since the filings deal with very different incidents, it makes sense that the information contained are also very different. However, the filings are consistent in that they focus on what is known and avoid speculations and predictions. The filings also do not share any details that are likely to change.<\/p>\n

Competing Obligations<\/h2>\n

There are three competing objectives that CISOs are simultaneously juggling:<\/p>\n