Highlighting The "SEC" In Cybersecurity: Continued Regulatory Focus On Preparedness And Response

In recent months, the U.S. Securities and Exchange Commission ("SEC") has emphasized cybersecurity as both an enforcement priority and corporate responsibility, demonstrating its continued focus on the need for issuers to have sufficient measures in place, including up-to-date compliance and incident response programs in order to maintain the integrity of the capital market system.

The SEC recently issued a Report of Investigation pursuant to Section 21(a) of the Securities Exchange Act (the "Report") that advised public companies to develop and implement internal accounting controls that include an approach to cyber threats.¹ The Report stemmed from an investigation of nine unidentified public companies that had fallen victim to cyber fraud in the form of "business email compromises." The nine issuers were defrauded into losing almost $100 million via wiring funds phished from compromised or spoofed emails claiming to be legitimate sources such as company