SEC Dismisses Cyber Disclosure Case Against SolarWinds And CISO

Key Takeaways

• The SEC's agreement with defendants to dismiss, with prejudice, its case against SolarWinds Corporation (SolarWinds) and its chief information security officer (CISO) signals a retreat from aggressive, novel enforcement theories in cybersecurity disclosure cases.
• Although technical cybersecurity violations without investor harm are less likely to result in enforcement action, the SEC's dismissal "does not necessarily reflect" its position on any other case. Vigilance remains essential, and retail investor protection remains central.
• The materiality determination in cybersecurity incidents, along with ensuring adequate disclosures, continues to be a key regulatory focus. Public companies should maintain diligence in these areas.