Part One

In the rapidly evolving domain of Operational Technology (OT) cybersecurity, 2024 stands as a pivotal year. Two major developments – the Securities and Exchange Commission’s (SEC) cybersecurity reporting rule and the release of NIST 800-82r3 – are set to reshape the landscape for cybersecurity expectations. This blog aims to provide OT operators with an understanding of these changes and practical recommendations for enhanced cybersecurity posture.

In this three-part series, we will look at the compelling regulatory and standards that emerged in 2023 that will drive focus and changes throughout 2024 in how OT operators look at “Enterprise risk.” 

Understanding the SEC Cybersecurity Reporting Rule and Implications for OT Operators

Released mid-2023, the SEC’s cybersecurity rule marks a transformative shift in how companies approach cybersecurity disclosures, with profound implications for Operational Technology (OT) environments. This rule compels companies to provide detailed disclosures about cybersecurity risks and incidents, a move that places a spotlight on the cybersecurity practices of OT operators, especially those in critical infrastructure sectors.

With the new rule, OT operators face increased scrutiny from investors, regulators and the public regarding their cybersecurity measures. The requirement to disclose significant cyber incidents means that any lapses in cybersecurity can have immediate financial and reputational repercussions.

The rule mandates a level of transparency that may be unprecedented for many OT operators. Disclosing cybersecurity risks and incidents requires a careful balance between transparency and safeguarding sensitive information, a challenge that is particularly acute in OT environments where security often hinges on obscurity.

The requirement to report significant cyber incidents not only highlights the importance of having robust detection and response mechanisms but also places incident response capabilities under the microscope. For OT operators, this means ensuring that their incident response plans are not just effective but also well-documented and capable of withstanding regulatory scrutiny.

To fortify the cybersecurity posture of publicly traded companies, the SEC’s cybersecurity rule mandates these entities to provide detailed disclosures about cybersecurity risks and incidents that could impact investors. For OT operators, this directive is not just a regulatory hurdle but a clarion call to elevate their cybersecurity defenses.

At its core, the SEC’s rule is designed to enhance transparency and accountability in how companies manage and report cybersecurity threats. This includes a requirement for timely reporting of significant cyber incidents and a more comprehensive disclosure of cybersecurity risk management practices and governance. The rule aims to ensure that investors, and the market at large, are well-informed about the cyber risks companies face and how they are mitigating these threats.

Enhanced Disclosure Requirements: OT operators, particularly those within critical infrastructure sectors, must now scrutinize their cybersecurity frameworks under the lens of disclosure. This involves a thorough assessment of how cyber threats could impact operations, financial performance and investor interests.

Operational Resilience: The rule underscores the need for OT operators to not only secure their networks but also ensure operational resilience. This means having robust systems in place to quickly recover from cyber incidents, minimizing disruptions to critical operations.

Cross-Departmental Collaboration: Compliance with the SEC’s rule necessitates a seamless collaboration between IT, OT, cybersecurity and corporate governance teams. OT operators must bridge the traditional gap between operational technology and information technology, ensuring that cybersecurity measures are holistic and encompassing.
Investor Relations: The rule also brings cybersecurity into the realm of investor relations. OT operators must now communicate their cybersecurity posture and incident response strategies in a manner that is transparent and reassuring to investors, highlighting the measures in place to protect shareholder value against cyber threats.

Proactive Risk Management: The SEC’s rule encourages a shift from reactive cybersecurity practices to a more proactive risk management approach. OT operators are urged to continuously identify, assess and mitigate cyber risks, adapting to the evolving threat landscape with agility.

Navigating Compliance and Beyond: Compliance with the SEC's cybersecurity rule is not merely about meeting regulatory obligations. For OT operators, it is an opportunity to reassess and strengthen their cybersecurity frameworks, ensuring that they are equipped to protect against and respond to cyber threats effectively. By embracing the principles of transparency, resilience and proactive risk management mandated by the rule, OT operators can safeguard not just their operational integrity but also their reputation and stakeholder interests.

Recommendations for OT Operators: Considering the SEC’s cybersecurity rule, OT operators must take proactive steps to not only comply with the new requirements but also to enhance their overall cybersecurity posture.

OT operators should initiate comprehensive cybersecurity audits to identify potential vulnerabilities within their systems. These audits should comprehensively encompass both IT and OT assets, providing a holistic view of the cybersecurity landscape and identifying areas where security measures may need to be bolstered. Visibility is the primary criterion for securing any assets. If full visibility of OT assets is a challenge, that may become the priority to address. 

Developing robust reporting mechanisms is crucial for compliance with the SEC’s rule. OT operators should establish clear protocols for identifying, assessing, and reporting cybersecurity risks, vulnerabilities, and incidents. This includes setting up dedicated channels for incident reporting, ensuring timely internal communication, and preparing templates for external disclosures that comply with regulatory requirements.

OT operators must ensure that their incident response plans are up-to-date, comprehensive and tailored to the unique challenges of OT environments. This involves regular training for response teams, conducting simulation exercises and continuously refining response strategies based on lessons learned from past incidents.

Compliance with the SEC’s cybersecurity rule is not a one-time effort but a continuous process. OT operators should establish ongoing compliance programs that include regular policy reviews, compliance audits and updates to cybersecurity practices in response to evolving threats and regulatory landscapes.

Creating a culture of cybersecurity awareness across all levels of the organization is essential. This involves regular training sessions, cybersecurity awareness campaigns and clear communication about the importance of cybersecurity in safeguarding the organization's assets and reputation. But education alone is not enough. Creating a culture of security also includes looking at business and operational policy and processes to ensure that security is built in so that compromising security with an “oops” (an error or omission) is less likely and tightly controlled. 

By embracing these recommendations, OT operators can not only navigate the challenges posed by the SEC’s cybersecurity rule but also strengthen their defenses against an increasingly complex threat landscape, ensuring the resilience and security of critical infrastructure.

Part two of this three-part series will be released on March 13, where we will look at the compelling regulatory and standards that emerged in 2023 that will drive focus and changes throughout 2024 in how OT operators navigate enterprise risk.

More content in this series:

• Navigating the New Landscape of OT Cybersecurity in 2024: Part 2
• Navigating the New Landscape of OT Cybersecurity in 2024: Part 3

Ready to learn more? Discover What's New in OT/ICS Cybersecurity.