The Securities and Exchange Commission (SEC) of the United States has adopted new regulations that require public companies to disclose material cybersecurity incidents within four days. To the positive, this initiative seeks to increase transparency and safeguard investors against potential cybersecurity risks. However, it also puts new weight and responsibility on enterprises that may not yet be ready for the challenge. Meeting this stringent 4-day standard means that enterprises now must be able to investigate cyberattacks swiftly and precisely to determine the significance of security incidents. This was more feasible when incidents primarily impacted on-premises environments. Now that the threat landscape extends across multi-cloud and SaaS environments, there is an added measure of complexity in meeting the expectation.  

What the New SEC Cyber Disclosure Rules Mean for Enterprises

Companies must promptly evaluate the severity of a data breach and cybersecurity incident to determine if it is "material" and requires immediate disclosure. This requires addressing three fundamental concerns regarding the occurrence:

1. What access did the attacker gain in the cyber incident? It is crucial to quickly determine the extent of an attacker's access to an organization's systems. Enterprises must determine whether the intruder obtained unauthorized access, deeply penetrated critical infrastructure, or merely scratched the surface. 

2. What data was compromised? Understanding the scope of data compromised during a cyber attack is crucial for assessing the enterprise’s potential risks and impact on its stakeholders. Identifying sensitive data that may have been compromised can aid in the formulation of an appropriate response.  

3. Where did the attack originate? Determining the attack vector, i.e., the method used by the perpetrator to infiltrate the organization's network, is essential for assessing the sophistication level and potential cybersecurity risk. This data can inform future security measures and cybersecurity practices and aid in the prevention of similar assaults.

Developing New Capabilities for Rapid Breach Investigations

To meet the SEC rule on stricter reporting deadlines, enterprises will not only require new organizational focus but also need to be enabled with the latest incident response capabilities. For example, enterprises must seek solutions that cover them across all their cloud and SaaS environments, offer greater degrees of visibility and breach readiness, and can analyze the forensic data collected to provide swift answers. Because traditional incident response methods routinely require weeks and months to collect data following a breach, it becomes clear how vital innovative approaches are.

Migita’s Threat Detection, Investigation and Response Solution Supports the SEC Requirement

Mitiga's automation platform provides an all-inclusive solution for cloud and SaaS environments that supports enterprises, before, during, and after an attack through a mix of readiness, risk management, threat detection and hunting, and automated response capabilities. We help organizations prepare for potential cyber assaults and cybersecurity threats by proactively constructing a Cloud Security Data Lake and streaming the necessary forensic data to it from across their cloud and SaaS environments. When breaches occur, investigations can commence immediately. By using the leading-edge IR automation that we term “Forensics as Code,” our responders support team to provide swift answers. This approach significantly cuts response times that used to be measured in days and weeks to hours. Understanding the scope and impact of the breach and cybersecurity incident enables businesses to make informed decisions about the significance of an attack and efficiently report to regulatory authorities, thereby assuring compliance and protecting shareholder interests.