When I was a CISO at RedSeal, the company had already built a culture of security that was great to build upon. Every employee was referred to as a cyber warrior. This made it easy for me to build upon this security-minded culture. One thing that everyone needs to know is that security is not simply the information security team’s responsibility. Security is everyone’s responsibility, from the CEO down to every employee. As more and more regulations are enacted, security being everyone’s responsibility is becoming more laser-focused and required.

The Security Exchange Commission (SEC) issued a final rule on July 26, 2023, which requires disclosures on “cybersecurity risk management, strategy, governance, and incidents.”

The SEC ruling mandates that material cyber incidents be reported on Form 8-k item 1.05. In addition, the board and executive management need to be fully aware of the actual risks...