An uncontroversial issue lurks quietly beneath the more turbulent environmental, social, and corporate governance (“ESG”) waters: cybersecurity. Regulators are actively releasing guidance on security measures and best practices, prescriptions that have broadened beyond institutional resiliency to include proactive monitoring and management of vendors and suppliers. This trend stems in part from broadly applied international and state consumer privacy-laws requiring disclosure of related parties that handle data[2] and permitting individuals to bring lawsuits for unreasonable security. [3] Here are some recent examples:

• FTC amends the GLBA Safeguard Rule. The Federal Trade Commission (“FTC”) recently amended[4] the Gramm-Leach-Bliley Act (“GLBA”) Safeguard Rule[5] to reflect developments in new technologies, including requiring nine security updates to company policies and procedures by June 9, 2023:
  1. Designating a “qualified individual” to oversee the institutions’ information security system;
  2. Ensuring that individual reports regularly to the board of directors regarding the state of the institutions’ information security programs;
  3. Conducting risk assessments of their information security programs;
  4. Implementing additional administrative, technical, and physical safeguards to address risks;
  5. Regularly testing security controls and safeguards;
  6. Ensuring personnel is adequately trained on security policies and procedures;
  7. Assessing and overseeing third-party service providers to ensure they are following the proper standards in their security programs;
  8. Establishing written incident response plans; and
  9. Keeping the procedures current.[6]

      

• SEC rules for public companies and investment entities. On July 26, 2023, the U.S. Securities and Exchange Commission (“SEC”) adopted final rules for public companies implementing new disclosure obligations about cybersecurity incidents and risk oversight processes.[7] Among other things, the rules create a new triggering event on Form 8-K, requiring disclosure of material cybersecurity incidents within four business days of a determination that such incident is material (subject to narrow exceptions). Public companies (other than smaller reporting companies) will be required to comply with the new 8-K disclosure obligations starting on December 18, 2023. In addition, the SEC implemented new annual disclosure obligations with regards to cybersecurity processes and oversight, including disclosures regarding: (1) company processes for assessing, identifying, and managing risks from cybersecurity threats[8]; (2) any risks of cybersecurity threats that have materially affected or are reasonably likely to materially affect the company; (3) the board of directors’ oversight of cybersecurity risks and any board committee or subcommittee responsible for such oversight; and (4) management’s role in assessing and managing material risks from cybersecurity threats, including a description of management positions and/or committees responsible for oversight and their relevant expertise. For domestic public companies, these new disclosure obligations will apply to their Annual Reports on Form 10-K covering fiscal years ending on or after December 15, 2023.

  Also of note, the SEC has proposed rules for investment advisors and funds,[9] amending Rule 10[10] and Form SCIR[11], that would require periodic risk assessments; minimization of user-related risks; protection of information from third-party service providers; cybersecurity threat and vulnerability management; and measures to respond and recover from cybersecurity incidents. And under proposed enhancements to Regulation S-P,[12] broker-dealers, investment companies, and similar entities would face similar policy and breach-incident reporting requirements.[13]

• Financial-institution guidance on third-party relationships. Numerous regulators have released guidance on third-party relationships. The Office of the Comptroller of the Currency (“OCC”), Federal Deposit Insurance Corporation (“FDIC”)[14], and the Board of Governors of the Federal Reserve System (“Federal Reserve Board”), finalized their Interagency Guidance on Third-Party Relationships in early June 2023 to recommend best practices for relationships with third-party service providers.[15] The agencies framed the guidance in terms of the “Third-Party Relationship Life Cycle,” which includes planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. Similarly, the Federal Financial Institutions Examination Council (“FFIEC”) publishes an Examination Handbook to provide guidance on tackling major issues,[16] including “Information Security”[17] and “Outsourcing Technology Services.”[18] These booklets provide guidance to identify, measure, mitigate, and monitor information security risks, especially when it comes to unauthorized third parties. Finally, the CFPB has issued bulletins guiding financial institutions to oversee their third-party relationships to ensure compliance with federal consumer finance laws.[19]

• Bank and credit union incident notification. Regulators are also shortening breach notification requirements. The OCC, FDIC, and Federal Reserve Board released the Computer Security Incident Notification Rule[20] to incentivize banks and bank service providers to timely notify regulators of “notification incidents,” material “computer security incidents” likely to materially disrupt or degrade a bank’s (1) ability to carry out operations, activities, or processes or deliver products or services to a material portion of its customer base; (2) business lines resulting in material loss of revenue, profit, or franchise value; or (3) critical operations, discontinuance of which would pose a threat to the country’s financial stability.[21] A bank must notify its regulator within 36 hours after discovering that a notification incident has occurred and a bank service provider must notify its consumers as soon as possible after an incident causes material service disruption of four or more hours.[22] Effective September 1, 2023, the National Credit Union Administration (“NCUA”) released a final rule requiring federally insured credit unions to report cyber incidents no later than 72 hours[23] after the credit union “reasonably believes” that it has experienced a reportable cyber incident.[24]

***

Whether mandated or not, these standards affect all businesses. Regulated companies must achieve reasonable compliance. But any company that does not implement some cybersecurity initiatives—including active vendor and supplier management—will be left defending decisions to ignore evolving standards supported by lower-cost solutions.[25] And for those businesses planning to acquire or sell, cybersecurity affects deal value and time to close, and good governance generally signals sophistication and trust. [26] So, in this and coming years, don’t forget the C in ESG and make cybersecurity a corporate governance priority.