SEC Expands Scope Of Internal Accounting Controls In Cybersecurity Breach Settlement

The SEC continues to expand its cybersecurity enforcement authority to include allegations that a company's failure to monitor its managed security service providers (MSSP) amounts to violations of federal securities laws. Recently, the SEC brought settled charges against R.R. Donnelley & Sons Co. (RRD or the Company). In the settlement order, the SEC alleged that RRD failed to maintain effective disclosure controls to inform decision-makers promptly with all relevant information concerning cyber alerts from monitoring tools and cybersecurity incidents. In a first-of-its-kind settlement, the SEC alleged that RRD failed to maintain internal accounting controls because the Company 1) failed to have sufficient controls to oversee its MSSP, 2) had inadequate cyber alert review protocols and 3) maintained insufficient cybersecurity access controls. The issue of whether internal accounting controls apply to cybersecurity access controls is hotly contested in the SEC v.