The SEC Won't Let CISOs Be: Understanding New SaaS Cybersecurity Rules
Jan 31, 2024
SaaS Security / Regulations
The SEC isn't giving SaaS a free pass. Applicable public companies, known as "registrants," are now subject to cyber incident disclosure and cybersecurity readiness requirements for data stored in SaaS systems, along with the 3rd and 4th party apps connected to them. The new cybersecurity mandates make no distinction between data exposed in a breach that was stored on-premise, in the cloud, or in SaaS environments. In the SEC's own words: "We do not believe that a reasonable investor would view a significant data breach as immaterial merely because the data are housed on a cloud service." This evolving approach comes as SaaS security shortcomings continually make headlines and tech leaders debate how the SEC may change cybersecurity after charging both SolarWinds and its CISO with fraud. Why SaaS and SaaS-to-SaaS Connection Risks Matter to the SEC — And To Your Organization The perception and reality of SaaS security are, in many cases, miles apa...
