SEC Cyber Enforcement Update: Which Way Are The SolarWinds Blowing? Part 2: Disclosure And Internal Controls

This Holland & Knight blog post is the second installment in a two-part series that examines the challenges to the U.S. Securities and Exchange Commission's (SEC) charges in its landmark case against SolarWinds Corp. (SolarWinds) and the company's Chief Information Security Officer (CISO) Timothy Brown. Part 1 examined the SEC's material misrepresentation claims and provided a detailed background on the case and its current status. This article explores the challenges to the SEC's deficient disclosure and internal controls claims and the potential impact of the Court's decision on these issues to the future of SEC cyber enforcement actions.

On Feb. 16, 2024, the SEC filed an amended complaint (Complaint) that charged SolarWinds and Brown with scienter-based antifraud provisions of the federal securities laws, violations of disclosure controls and violations of internal controls. In its Complaint, the SEC claims that SolarWinds and Brown made