In a commentary for D&O Diary, David Fontaine, CEO of Kroll, Inc., and John Reed Stark, former Chief of the SEC’s Office of Internet Enforcement, examine the SEC’s recent cybersecurity disclosure guidance for publicly traded companies, with a particular focus on what the agency’s statement has to say about the duties of corporate directors.
They note that the SEC’s views on the role of the board have evolved over the past few years, and the new guidance shows its strong views regarding its essential role in the emerging area of enterprise risk. When it comes to cybersecurity, directors are expected to dig in and demand greater visibility into the matter.
They provide further background, followed by more specific recommendations of board actions:
- It starts with the CEO.
- Reject the “check the box” approach to security compliance.
- Assign clear board-level oversight responsibilities.
- Boards must require periodic external assessments, testing, and reporting.
- Don’t fall prey to a false sense of confidence.
- It’s more than just prevention.
- Take the time to understand what has gone before.