Cybersecurity & Information Protection

At a minimum, regulators will continue to focus on companies’ efforts to strengthen governance and risk management around the security of systems and data both internally and through affiliates and third/nth parties.

Regulatory areas in the spotlight may include:

Compliance

With existing security-related rules and requirements, such as the SEC Cybersecurity Final Rule for Public Companies, Interagency Guidance on Third-Party Risk Management, and the FTC Safeguards Rule as well as the potential for new rulemakings and frameworks/guidance specific to cybersecurity, data privacy, or AI.

Privacy Practices

As part of an ongoing focus on data minimization, usage, deletion/disposal, controls, and consent.

Data Classification/Tiering

Given the heightened focus on data governance and management practices over risk management data, regulators will increasingly assess data classification and tiering based on data sensitivity, integrity, availability, and criticality, with due consideration for data sovereignty and localization requirements under data privacy laws.

Parties & Providers

Including companies’ abilities to demonstrate effective risk-based oversight for all types of relationships/ arrangements, giving consideration to market concentration, the interconnectedness of providers, and supply chain risks as well as assessing the provider’s ability to meet compliance obligations (e.g., incident reporting requirements) and to protect data privacy/ security.

Staffing/Resources

To ensure that cyber/data personnel possess the specialized knowledge and skills necessary to identify, analyze, and remediate emerging threats, and also that the relevant workforce is adequately staffed and resourced.

• Enhance board and executive oversight: Strengthen the oversight of security risk management, strategy, and governance at the board and executive level. Conduct regular communication and reporting between executives, management, and the board to foster a proactive approach to identifying, monitoring, and mitigating potential security threats as well as timely incident response.
• Third party risk assessments: Maintain a broad inventory and perform a risk assessment of third parties involved in the delivery of business software and services to assess their operational viability, financial health, security practices, compliance history, and previous incidents. Assess potential for over dependence or over-concentration on a small number of parties/providers.
• Resiliency: Cultivate a culture of resilience, embedding robust contingency plans that encompass not just IT infrastructure but also key business operations. Conduct regular impact assessments using a variety of scenarios.
• Data Security: Build a comprehensive inventory of data (at rest and in transit) across the organization. Identify and label “crown jewel” data assets, and categorize and classify structured and unstructured data, and assess threats, vulnerabilities and risks. Align proactive monitoring and preventative data protection controls to identified data assets based on risk exposure such as Data Loss Prevention (DLP), encryption, data masking, and use of synthetic data to mitigate risk exposure to a level aligned with organizational risk tolerance and regulatory posture.
• Recovery Planning: Evaluate the ability to handle recovery at scale and under pressure; develop/ modify the backup and recovery plan as appropriate.
• Maintain transparent and timely reporting: Implement a system for transparent and timely reporting of security threat incidents, as required by regulatory authorities. All incident- related information should be accurate, up to date, and communicated to the appropriate stakeholders, including regulatory agencies and customers, as appropriate.
• Enhance Vulnerability Management Practices: Deploy advanced tools and processes for continuous vulnerability detection. Prioritize remediation efforts based on risk assessments and promptly address vulnerabilities to mitigate potential threats.