U.S. rule requires public companies to disclose cybersecurity breaches in 4 days::The Securities and Exchange Commission adopted rules Wednesday to require public companies to disclose within four days all cybersecurity breaches that could affect their bottom lines. Delays will be permitted if immediate disclosure poses serious national security or public safety risks.

  • evatronic@lemm.ee
    link
    fedilink
    English
    arrow-up
    14
    ·
    1 year ago

    Technically, the clock doesn’t start ticking on the four-day window for reporting until companies have determined a breach is material.

    It’s not all breaches. In fact, because this is the SEC, it’s about financial impact, not privacy or security.

    It’s a good start, but I worry that a financial impact based approach creates the wrong incentive.

  • ezchili@iusearchlinux.fyi
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    Public companies, really? They only managed to gather political will to impose that with securities in mind?

    • ech0@lemdro.id
      link
      fedilink
      English
      arrow-up
      35
      ·
      1 year ago

      Eh I disagree. You have to give companies time to patch their shit. If they disclose hours or days before they have time to patch that can lead to another breach assuming the vulnerability is shared.

      But yes fuck Corporations.