What Do Rainbow Trout Have to Do with the New SEC Cybersecurity Regulation?

The serenity, solitude, and deafening silence of the river rushing past your knees, surrounded by snowcapped mountains while fly fishing is tough to beat. The beauty that engulfs your senses slowly lulls you into a daydream sequence. Trout aren’t super active in the winter, so the expectation of a catch is minimal. You slip further into your mind and then…BOOM! Fish on! You’re suddenly jostled from being alone with your thoughts, fighting to land what’s sure to be a nice fish – they usually are in the winter months.

But what does this have to do with security?

Make no mistake, there’s nothing serene, solitary, silent, or even remotely enjoyable about regulatory requirements. They’re an important and necessary component of the daily lives of practitioners and services providers. The commonality is that we’re in a daydream sequence when it comes to SOX 404. We’ve become desensitized to it because it’s overloaded every aspect of our conversations, conferences, social media feeds, and vendor relationships. We’ve been bludgeoned with content targeting GDPR and other similar privacy regulations – and that’s just scratching the surface. Fast-forward to the here and now. We’re standing in that river of regulatory compliance, desensitized to the reality that a beautiful, native rainbow trout could be on our line at any moment.

In the world of regulatory compliance, that trout is the new SEC Cybersecurity Regulation.

Much like me scrambling to set the hook and strip line, we’re all in a position of needing to quickly rotate to address the newest requirements passed down from the SEC – whether we’re ready or not..

At a high level, the goal of the new requirements is enhancing the cybersecurity practices of publicly traded companies’ as they relate to risk management and governance, while increasing transparency around cybersecurity events. Specifically, an organization must provide a comprehensive disclosure of its processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats.

But let’s not forget about our friends at privately held companies. You may be impacted as well, particularly if you’re looking to interoperate with publicly traded companies from a vendor, partner or other 3^rd party relationship perspective.