A cybersecurity breach involving theft of a company's
customer data could mean that the company has a weakness, which
could be material, in its internal control over financial reporting
(ICFR) related to controls over the safeguarding of assets. To
minimize the possibility of cyber theft, companies should examine
their controls over customer data as well as other assets to be
sure that they are sufficient. To the extent that a company
outsources information management activities, the company must also
ensure that the providers of those activities have adequate
controls over the company's customer data and any other company
assets.
Rule 13a-15(f) of the Exchange Act defines ICFR as a process to
provide, among other things, "reasonable assurance regarding
prevention or timely detection of unauthorized acquisition, use or
disposition of the issuer's assets that could have a material
effect on the financial statements." According to the SEC's adopting release on ICFR,
