The newly expanded SEC Rule 17 covering Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure takes effect on December 15, 2023.

The rules require public companies to disclose material information on an annual basis regarding their cybersecurity risk management, strategy, and governance. This includes describing business processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.

This guide provides practical advice for CISOs on formulating a game plan for the next critical 90 days leading up to the disclosure rule deadline, including:

• Why cyber risk is enterprise risk
• What operational risk is and how OT and IoT systems play a role
• Tips for educating your board on cybersecurity
• Key definitions and thresholds to establish with your CFO, legal team and other executive stakeholders