The Securities and Exchange Commission's filing of a complaint alleging software company Solar Winds and its Chief Information Security Officer Timothy G. Brown misled investors about the company's cybersecurity practices and known risks highlights the Commission's apparent strategy shift towards holding cybersecurity executives personally liable for misrepresenting the state of cyber defenses. Coupled with new mandatory disclosure regulations relating to major breaches and ransom payments, this action will necessitate public companies taking a look at their cyber defenses in a totally different light.
This represents a sea change in enforcement in that it places personal liability on the corporate executive responsible for maintaining the cyber defenses of a public company.
As I stated in my Bloomberg interview, CISOs around the country will now need to closely map their cybersecurity efforts against the Commission's areas of focus and ensure they are taking the appropriate steps to mitigate cyber threats and represent their efforts accurately in public filings.
Executive security officers and general counsels are likely to look closely at the violations alleged in the complaint side-by-side with their own compliance programs to identify any potential gaps, according to Timothy Gallagher, the chief security officer at Nardello & Co., an investigations firm. “Bringing penalties against someone in a CISO role is sending a message that even if your name is not on the 10-K and 10-Q filings you will be held personally accountable for either misstatements or omissions,” Gallagher said.
