If the Security and Exchange Commission’s February 2018
guidance on cybersecurity represented a wake up call, the Sept 26th enforcement settlement involving a
one million dollar penalty for failure to have appropriate
cybersecurity measures in place should be a very loud alarm bell of
warning to both executives and boards of directors.
The SEC’s guidance is based on the very real fact that an
organization’s financial, operational and technology systems
are intertwined, and that protecting the integrity of both a
company’s books and sensitive customer information are
inextricably linked to cyber security.
There is no lack of clarity in the message associated with this
settlement and penalty. The SEC expects companies to not only have
in place commercially reasonable standards, policies and procedures
for cyber security, but to implement them along with compliance and
audit procedures to assure that they are working as
intended.
