Imagine that the FBI and DHS have arrived at your company to inform you of a potential cyber threat. Your public company disclosure obligations may not be the first thing on your mind, but such issues will quickly emerge.

On Wednesday of this week, the U.S. Securities and Exchange Commission (SEC) held a roundtable on cybersecurity to explore whether the current SEC guidance on cybersecurity is working and how it could be improved. Panelists included an impressive array of government and industry representatives. SEC Chairwoman Mary Jo White, in her opening remarks, emphasized that the SEC’s 2011 guidance makes clear that “material information regarding cybersecurity risks and cyber incidents is required to be disclosed.”

SEC Solicits Public Comments

On its website, the SEC is soliciting comments about cybersecurity issues, including the risks facing public companies, investors and capital market infrastructure; the efficacy of the SEC’s 2011 disclosure guidance, and suggestions for improving disclosure. As we discussed in a previous Privacy Perspectives post and at the IAPP Global Privacy Summit, the SEC has been actively promoting its 2011 cyber guidance through staff comment letters on public company filings, but the effectiveness of the guidance has yet to be determined. This roundtable was designed to elicit additional perspectives on the guidance and how it can be improved.

Panelists debated a variety of cybersecurity issues, including:

• how to protect classified and sensitive information while providing investors with information they need to make informed voting and investment decisions;
• how to determine the materiality of a cyber event;
• the appropriate level of involvement by the board and management of public companies;
• how to get beyond boiler plate disclosure without exposing companies to risks posed by specific disclosures;
• how to foster better information sharing between the private sector and the government;
• whether there should be a unique disclosure regime around cybersecurity, and
• how best to protect capital markets infrastructure.

Is SEC the Right Agency?

One panelist, former SEC Commissioner Roberta Karmel, argued that the SEC may not be the right agency to push companies to do more by requiring more disclosure of breaches and other incidents that are not material—particularly, at a time when the SEC is looking to simplify its disclosure policies.

However, another panelist requested more robust guidance from the SEC, especially in light of recent staff comment letters that seek disclosure of prior incidents, even if those incidents are not material. Pointing to recent data that suggests that cybersecurity events impact stock prices less than they impact a company’s reputation, one panelist called for more guidance on the standard of materiality. If materiality does not require disclosure, there is a disincentive, one panelist suggested, to disclose breaches that may otherwise not become public since disclosure may subject the company to class-action and consumer protection suits.

Boards of Directors Increasingly Involved

Consensus prevailed among the panelists about the uptick in the level of involvement of public company boards of directors.

Boards increasingly want to understand the details of an attack, the perpetrators, the methods used, as well as appropriate short-term, mid-term and long-term responses to its various constituencies. But, as one panelist pointed out, “Boards need to realize that cybersecurity is not a problem not to get past” but rather that cybersecurity is an ongoing risk that boards must determine how to mitigate.

A few of the public company panelists, including WGL Holdings, Inc., and Washington Gas Light Vice President and General Counsel Leslie Thornton, noted they have placed cyber-experts on their boards. Debate ensued as to whether it was best practice to appoint a separate committee of the board to oversee cybersecurity issues or whether the audit committee should take on that task since it is typically involved in assessing enterprise risk management.

As one panelist pointed out, “Boards need to realize that cybersecurity is not a problem not to get past” but rather that cybersecurity is an ongoing risk that boards must determine how to mitigate.

Panelists also agreed on the necessity of having a cyber incident response plan in place and keeping it up to date.

On the issue of cybersecurity risks faced by capital markets participants, NASDAQ OMX Chief Information Security Officer Mark Graff called on the SEC to provide more guidance with respect to specific issues rather than catastrophic cybersecurity events for which they are authorized to cease trading until they can operate fairly. For example, he asked for guidance on how to deal with trades involving a brokerage house that was compromised and an order that was issued from such a compromised system. He stated that the most recent guidance he had received from the SEC indicated that such trade would not be considered erroneous and therefore could not be broken.

Similarly, Mark Clancy, managing director and corporate information security officer of the Depository Trust and Clearing Corporation, expressed concern that there is not guidance on how corruption events ought to be unwound, providing an example of some systems that might go to a snapshot four hours back and some systems that might go back six hours.

In her opening remarks, the SEC’s White stated that cybersecurity for Self Regulatory Organizations (such as the exchanges and FINRA) is an important area of SEC focus that involves the commission’s proposed rule on systems, compliance and integrity, which would require an entity covered by the rule to test its automated systems for vulnerabilities, test its business continuity and disaster recovery plans, notify the commission of cyber intrusions and recover its clearing and trading operations within specified time frames.

Will There Be an SEC Cybersecurity Task Force?

To keep the dialogue going, SEC Commissioner Luis Aguilar called for the commission to establish a Cybersecurity Task Force to be composed of representatives from each division of the SEC that would regularly meet and communicate with one another to discuss these issues. It is clear that the SEC is struggling with its role in cybersecurity incident response and how to be relevant without being too proscriptive in its notification requirements.

Hopefully this roundtable started the process to reconcile the two competing interests while not unduly burdening publicly traded companies.