Companies Could Face Federal Fines in Cyber Attacks

A U.S. Securities and Exchange Commission (SEC) report issued last week warns publicly held companies they may be in violation of federal law if lax internal controls are believed to lead to cyber-related fraud. Those violations could lead to SEC fines.

The report issued earlier this month follows a $1 million settlement the agency announced over an investment firm’s handling of a cyber breach.

In the report, the agency focused on two types of criminal cyber schemes: emails from fake executives and emails from fake vendors. It said the commission “deems it appropriate” to make issuers “aware that these cyber-related threats of spoofed or manipulated electronic communications exist and should be considered when devising and maintaining a system of internal accounting controls as required by the federal securities law.”

Thomas O. Gorman, a partner at Dorsey & Whitney LLP in Washington, said the report’s implication is that it’s not enough to have a “nice set of policies and procedures. You’ve got to really train your people and create an environment where they’re actively monitoring these things all the time and updating them all the time.”

Source: Business Insurance