Key Takeaways From Recent SEC Cybersecurity Enforcement Actions

The SEC recently announced disclosure settlements against four current and formerly public companies impacted by the highly publicized compromise of SolarWinds' signature network monitoring software, Orion. The settlements generally found that these companies used SolarWinds' Orion software, learned that the threat actor behind the SolarWinds Orion compromise had accessed their systems, and subsequently minimized the cybersecurity incident in their public disclosures. This client alert analyzes the cases and provides key takeaways for public companies.

Background

In 2023, the SEC brought fraud charges against SolarWinds and its CISO in connection with the Orion compromise, and we have covered the developments in this litigation here and here. In relevant part, the SEC alleged that SolarWinds, which provides various information technology management services to customers, overstated the steps it took to prevent cybersecurity incidents and then failed to tell the