HL Chronicle of Data Protection : Privacy Lawyers & Attorneys : Hogan Lovells Law Firm : Data Security, E-Commerce & Technology

In the introduction to the Guidance, the SEC Staff acknowledged that overly-specific descriptions of cybersecurity risks filed on the public record could serve as a road map to cybercriminals:

We are mindful of potential concerns that detailed disclosures could compromise cybersecurity efforts -- for example, by providing a “roadmap” for those who seek to infiltrate a registrant’s network security -- and we emphasize that disclosures of that nature are not required under the federal securities laws.

On when disclosure of cybersecurity risks should be disclosed in SEC filings, the Guidance states:

In determining whether risk factor disclosure is required, we expect registrants to evaluate their cybersecurity risks and take into account all available relevant information, including prior cyber incidents and the severity and frequency of those incidents. As part of this evaluation, registrants should consider the probability of cyber incidents occurring and the quantitative and qualitative magnitude of those risks, including the potential costs and other consequences resulting from misappropriation of assets or sensitive information, corruption of data or operational disruption. In evaluating whether risk factor disclosure should be provided, registrants should also consider the adequacy of preventative actions taken to reduce cybersecurity risks in the context of the industry in which they operate and risks to that security, including threatened attacks of which they are aware.

(emphasis supplied)

Thus, the Guidance plainly suggests that a risk assessment is necessary to make the determination on whether disclosure is called for.

In terms of what disclosure is called for, the Guidance states:

Depending on the registrant’s particular facts and circumstances, and to the extent material, appropriate disclosures may include:

• Discussion of aspects of the registrant’s business or operations that give rise to material cybersecurity risks and the potential costs and consequences;

• To the extent the registrant outsources functions that have material cybersecurity risks, description of those functions and how the registrant addresses those risks;

• Description of cyber incidents experienced by the registrant that are individually, or in the aggregate, material, including a description of the costs and other consequences;

• Risks related to cyber incidents that may remain undetected for an extended period; and

• Description of relevant insurance coverage.

   

The Guidance also advises registrants to address cybersecurity risks and cyber incidents in their MD&A if

the costs or other consequences associated with one or more known incidents or the risk of potential incidents represent a material event, trend, or uncertainty that is reasonably likely to have a material effect on the registrant’s results of operations, liquidity, or financial condition or would cause reported financial information not to be necessarily indicative of future operating results or financial condition.

The SEC Staff gave as an example:

if material intellectual property is stolen in a cyber attack, and the effects of the theft are reasonably likely to be material, the registrant should describe the property that was stolen and the effect of the attack on its results of operations, liquidity, and financial condition and whether the attack would cause reported financial information not to be indicative of future operating results or financial condition.

This SEC Guidance is likely to result in public corporations engaging is a substantial and detailed assessment of their cybersecurity risks to determine if public disclosure is required, and may lead to a litigation trend of plaintiffs suing corporation following a data security breach, alleging that the risks of such a breach were not properly assessed or disclosed.

The issuance of the cybersecurity disclosure guidance also raises the possibility that the SEC's long-dormant proposed revisions to Reg. S-P under the Gramm-Leach-Bliley financial privacy law, that add specific data security steps for companies to follow, may be finalized -- as part of the Commission's effort to address the growing concerns about cybersecurity in corporate America.

(1) Work with multi-stakeholder groups to develop, when necessary, nationally recognized and consensus-based cybersecurity standards and practices specific to the covered businesses.  This would include proactively promoting the adoption of particular keystone standards and practices, accelerating the promotion of automation in security, and improving and modernizing security assurance of third-party products.  One example provided by the report is the Domain Name System Security (DNSSEC) protocol extensions, which provide a way to ensure that users are validly delivered to the web addresses they request.

(2) Work with industry to create, through public policy and public/private partnerships and other means, new incentives for firms to follow nationally recognized standards and practices as consensus around them emerges.  This would include continuing to advocate for the adoption of a national breach notification law, facilitating the sharing of information about security breaches as they occur, and evaluating other public policy tools that can be used to promote cybersecurity best practices (such as liability protection and reducing “cyberinsurance” premiums for companies that adopt best practices and openly share details about cyberattacks).

(3) Work with the covered businesses and other federal agencies to deepen private sector and public understanding of cybersecurity vulnerabilities, threats, and responses in order to improve incentives, research and development, and education.  This would include developing a better understanding (at both the firm and the macro-economic level) of the costs of cyber-incidents and the benefits of greater security, the tailoring of future awareness-raising efforts (including through the National Initiative for Cybersecurity Education), and facilitating research and development for deployable technologies.

(4) Continue to enhance the Department’s international collaboration and cooperation activities regarding cybersecurity.  The green paper posits that continuing to work with international governments and businesses would promote shared research and development goals, enable the sharing of best practices and threat information, and promote cybersecurity standards and policies that are in line with and/or influence global practices.

The Department has asked interested parties to comment on the recommendations in the green paper, as well as to provide responses to specific questions it posed to help develop the recommendations.  Some of these questions include:

• What kinds of entities should be included or excluded from the covered businesses?  How can the the covered businesses' functions and services be clearly distinguished from critical infrastructure?
• Should covered businesses that also offer functions and services to covered critical infrastructure be treated differently than other covered businesses?
• Are there existing codes of conduct that covered businesses can utilize that adequately address these issues?
• What process should the Department of Commerce use to work with industry and other stakeholders to identify best practices, guidelines, and standards in the future?
• What are the right incentives to (a) gain adoption of best practices; (b) ensure that the voluntary codes of conduct that develop from best practices are sufficiently robust; and (c) ensure that codes of conduct, once introduced, are updated promptly to address evolving threats and other changes in the security environment?
• How can the Department of Commerce work with other federal agencies to better cooperate, coordinate, and promote adoption and development of cybersecurity standards and policy internationally?

The green paper comes on the heels of the Administration’s May report detailing its stance on cybersecurity policy, and its announcement that it will collaborate with experts in the private sector develop a new cybersecurity strategy.  The Department of Commerce’s position on cybersecurity should inform the Administration’s cybersecurity strategy as it progresses.

Many government contractors are watching this legislation carefully. It includes a proposal to revise the Federal Acquisition Regulation (FAR) in order to establish minimum information security requirements for procurement of IT products and services, and a proposal to adopt policies for evaluating and mitigating supply chain security risks associated with products or services acquired by agencies. More generally, the bill would apply yet-to-be-developed security requirements to any federal agreement that supports the operation and assets of an agency.

The security requirements would apply to government contractors and grantees that collect, use, manage, store, or disseminate information on behalf of an agency, or that use or operate an information system or information infrastructure on behalf of the agency. Whether and to what extent contractors and grantees engage in the foregoing activity has been a source of confusion, both within and outside the government, particularly as it relates to compliance with FISMA. Data security conditions (including FISMA terms) increasingly are incorporated into federal agreements, catching some contractors and grantees off guard. Moreover, as the private sector moves toward a cloud computing platform, the evolving federal cybersecurity policies likely will affect how organizations use cloud services in the performance of contracts and grants.  Organizations may need to start treating cloud service providers as subcontractors, and contractually impose federal data security requirements on these providers. It is too early to tell how these and other important issues ultimately will play out under the new legislation.

The legislation includes other salient items, as follows:

• Annual audits: Requires agencies and contractors to obtain an annual independent audit of their information security programs for overall effectiveness and compliance with FISMA.
• Federal Chief Technology Officer (Federal CTO): Establishes a Federal CTO, appointed by the President and confirmed by the Senate, to work across agencies and the private sector on information technology considerations with regard to federal budgets, and with regard to research and development programs for information technology-related matters.
• Critical infrastructure: Defines “critical information infrastructure” and provides authority to the Secretary of Homeland Security to issue measures for the protection of information systems that control critical infrastructure. Importantly, the legislation does not appear to give Homeland Security an “internet kill switch” and related control over private systems.
• Educational programs: Establishes a “Cyber Challenge Program” to support educational programs designed to engage students and the workforce in skill sets relevant to advanced cybersecurity capability.