SEC Cyber Enforcement Update: Which Way Are The SolarWinds Blowing?

The SEC has been aggressively pursuing cybersecurity investigations and enforcement actions against public companies and foreign private issuers. In these actions, the SEC often alleges one of two theories: 1) that the company made material misrepresentations in its disclosures about cybersecurity risks or concerning a material cybersecurity incident¹ and 2) that the company maintains deficient disclosure and/or internal controls to ensure material cybersecurity risks are timely and accurately assessed and disclosed by appropriate decision-makers.²

Both theories are on full display in the SEC's landmark enforcement action against SolarWinds Corp. (SolarWinds or the Company) and the Company's Chief Information Security Officer (CISO) Timothy Brown, through a complaint it filed last year in the U.S. District Court for the Southern District of New York (Court). The complaint represents the SEC's first-ever litigated action against a public company concerning its