To provide CPAs and other finance professionals with a practical understanding of current cybersecurity-related SEC rules and regulatory developments, enabling them to better assess disclosure obligations, manage compliance risk, and strengthen cybersecurity governance and reporting practices.

• Refresher: SEC cybersecurity risk management, strategy, governance, and incident disclosure rule
• SEC implementation, industry practice and key trends
• SEC enforcement update:
  – Patterns from recent investigations and enforcement actions
  – Case study: SolarWinds
• Impact and practical applications of the 2023 rule
• Amended Regulation S-P: overview and compliance
• Materiality assessment considerations and disclosure controls
• Governance and incident response lessons learned

Stephenie Gosnell Handler, Gibson, Dunn & Crutcher LLP

To help CPAs and other finance professionals understand current cybersecurity regulatory requirements and develop practical approaches for assessing risk, preparing disclosures, and supporting compliance efforts.

DETAILED LEARNING OBJECTIVES

• Understand the SECs 2023 cybersecurity disclosure requirements including the timing and conditions for Form 8-K filings

• Identify when it is appropriate to use Item 1.05 of Form 8-K based on SEC guidance

• Recognize the governance and risk management topics that must be disclosed under the new SEC cybersecurity rules

• Describe the nature of the SEC’s enforcement action against SolarWinds and its relevance to disclosure obligations

• Identify SEC enforcement focus areas related to cybersecurity disclosure controls and procedures 

• Determine the appropriate trigger for public disclosure of a cybersecurity incident under SEC rules

• Understand key legal limitations on the SECs authority to regulate cybersecurity controls highlighted by the SolarWinds case 

• Recognize practical compliance steps for implementing the SEC’s 2023 Cybersecurity Rule

• Reporting Obligations
  – Incident disclosures
  – Governance
  – Risk factors
• Key Provisions of the 2023 Rule
• Assessing Materiality for Cybersecurity Incidents
• The Gerding Statement and its Impact
• Materiality Determination
• Overall Disclosure Trends
• Results of Recent Investigations and Enforcement Actions
• A Case Study of the SEC’s Complaint against SolarWinds
• Practical Application of the 2023 Rule:
  – Cybersecurity incident response playbook
  – Processes for managing cybersecurity risk
  – Drafting of disclosures
  – Materiality determinations
  – Internal policies and procedures
  – Preparing for an SEC investigation

Sarah Pongrace, Senior Associate, Gibson Dunn