The Securities and Exchange Commission (SEC) finalized new rules last week by a vote of 3-2 that will require public companies to disclose more information about cybersecurity-related incidents, risk management, strategy, and governance. A joint comment letter by The Real Estate Roundtable and Nareit about the SEC proposal was cited nearly a dozen times in the final rule. (SEC fact sheet | Roundtable-Nareit comment letter, May 9, 2022)
The Roundtable and Nareit expressed a number of concerns in their May 2022 letter about the proposed rule’s rigid incident reporting deadlines and granular requirements, which the industry organizations stated may unintentionally exacerbate cybersecurity risks for issuers while imposing unjustified burdens. (Roundtable Weekly, May 13, 2022)
Under the new rules, registered companies must report cyber-attacks by filing an 8-K form with the SEC within four business days, which The Roundtable and Nareit objected to in their joint letter.
Responding to these concerns, the SEC stated in its final rule that it is “… providing for a delay for disclosures that would pose a substantial risk to national security or public safety, contingent on a written notification by the Attorney General, who may take into consideration other Federal or other law enforcement agencies’ finding.” (Pensions and Investments, July 26)
The SEC also responded to industry concerns by stating it had “streamlined” its requirements on cyber-attack disclosures to focus more on the potential effects, rather than the details of the incident itself. (Wall Street Journal, July 26 | PillsburyLaw and GreenbergTaurig)
The agency states in its final rule, “To that end, to balance investors’ needs with the concerns raised by commenters …The final rules will require the registrant to describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.”
Public real estate companies will also be required to disclose the board of directors’ oversight of cybersecurity threats, identify any board committee (or subcommittee) responsible for cybersecurity oversight, and the processes by which the board or (sub) committee is informed about these risks.
The final SEC rule will become effective on September 5, according to a notice today in the Federal Register. All registered public companies, other than smaller reporting companies, must begin complying by Dec. 18, 2023.
The Roundtable’s Homeland Security Task Force will remain engaged with government officials and private sector partners on industry best practices to detect, protect, and respond to a variety of key threats, including cyber-attacks.
Federal guidance on cyber insurance policies is the focus of a new bipartisan Senate bill introduced on Feb. 21 that aims to protect businesses and consumers against cyberattacks. (PoliticoPro, Feb. 21)
The Insure Cybersecurity Actwill direct the National Telecommunications and Information Administration (NTIA) to mitigate digital risk by developing recommendations for issuers, agents, brokers, and customers to improve communication over cybersecurity insurance coverage levels.
Co-sponsored by Sens. John Hickenlooper (D-CO) and Shelley Moore Capito (R-WV), the bill also directs a NTIA task force to develop policy recommendations relating to ransomware or ransom payments, and the “terminology used in policies to include or exclude losses” due to cyber terrorism or acts of war.
A 2021 Government Accountability Office report found that ambiguity in policy language can result in misunderstandings and litigation between issuers and policyholders—and underestimations of coverage needed to protect against cyber risks.
The Roundtable’s Homeland Security Task Force continues working with the Real Estate Information Sharing and Analysis Center (RE-ISAC), federal officials, and real estate companies about threats to the business cyber environment with the aim of mitigating cyber intrusions.
“Higher-than-expected interest rates could lead to increased volatility in financial markets, stresses to market liquidity, and declines in asset prices, including prices of both commercial and residential real estate properties,” the central bank states in its report.
The report warns that such effects could cause losses at a range of financial intermediaries, reducing their access to capital and raising their funding costs—and pose adverse consequences for asset prices, credit availability, and the economy.
Federal Reserve Vice Chair Lael Brainard stated the American financial system has held up through the turbulent developments of the past year. She said, “Household and business indebtedness has remained generally stable, and on aggregate households and businesses have maintained the ability to cover debt servicing, despite rising interest rates.”
Respondents to the central bank’s survey on stability threats also noted continuing concerns about the Russian invasion of Ukraine, high oil prices and a potential conflict between China and Taiwan. Cyber attacks pose an additional risk that “could come as retaliation for sanctions imposed on Russia,” according to the Fed’s report.
The Roundtable’s Homeland Security Task Force will hold a conference call on Monday, November 28 that will focus on a new Cyber Risk Summary briefingon Commercial Facilities—includes Commercial Real Estate—from the Cybersecurity and Infrastructure Security Agency (CISA). [To register, contact Andy Jabbour of the Real Estate Information and Sharing Network (RE-ISAC)]
U.S. financial institutions processed approximately $1.2 billion in ransomware-related payments last year, a nearly 200 percent increase compared to 2020, according to the Treasury Department’s Financial Crimes Enforcement Network. (FinCEN report, Nov. 1)
Cybersecurity issues and CRE will be discussed during the next HSTF meeting on Jan. 25, 2023—held in conjunction with The Roundtable’s State of the Industry meeting. (Roundtable Weekly, Oct. 7)
As cyberattacks pose an increasing threat to the real estate industry and the U.S. economy, the government is seeking input from policyholders, critical infrastructure owners, and operators on a potential federal response for catastrophic cyber incidents, including whether a national cyber reinsurance program is warranted. (Treasury Department Notice, Sept. 29 and NextGov, Sept. 28)
Response to Catastrophic Cyber Attacks
The Treasury Department’s Federal Insurance Office (FIO) and the Cybersecurity and Infrastructure Security Agency (CISA) are seeking comments by Nov. 14 on the structure and scope of a federal response. (FIO request for comments and Inside Cybersecurity, Sept. 12)
Insurers and the federal government’s Terrorism Risk Insurance Program (TRIP)may not cover the expanding range of such losses. For example, TRIP may only cover cyberattacks if they can be considered “terrorism” under its defined program criteria. (Roundtable Weekly, June 24)
Separately, CISA is requesting input on the implementation of cyber incident reporting requirements (due Nov. 14). CISA is also hosting a series of public listening sessions in cities throughout the nation as an additional means of gathering stakeholder responses on definitions for the proposed rules, the form and content of reports, enforcement procedures, and information protection policies. (Federal Register and Notice of Public Listening Sessions, Sept. 12)
The US Government Accountability Office (GAO) recommended in a June 21 report that the federal government should assess the need for a potential insurance backstop for cyberattacks on critical infrastructure. (GAO summary “Cyber Insurance: Action Needed to Assess Potential Federal Response to Catastrophic Attacks”)
Growing Cyber Threats
With the growing proliferation of cyberattacks, the challenge of mitigating and managing this expanding risk poses an increasing challenge to the U.S. economy and real estate.
Insurers and the government’s terrorism risk insurance program originally established under the Terrorism Risk Insurance Act (TRIA) may not be able to cover the expanding range of such losses. For example, TRIA may only cover cyberattacks if they can be considered “terrorism” under its defined program criteria.
The Roundtable has raised concerns about the need for policyholders to have access to effective insurance products to help manage the risks of catastrophic cyberattacks—particularly in the context of TRIA-backed coverage for cyber terrorism attacks. (See May 16, 2022 joint comment letter on “2022 Report on the Effectiveness of the Terrorism Risk Insurance Program”)
This month’s GAO report acknowledges that although some cyber incident costs are covered in part by the private cyber insurance market, growing cyber threats have created uncertainty in this evolving market.
The report also notes that cyber incidents can spill over from the initial target to economically linked firms, thereby magnifying damage and threats to the overall economy. “Cyber insurance and the Terrorism Risk Insurance Program (TRIP)—the government backstop for losses from terrorism—are both limited in their ability to cover potentially catastrophic losses from systemic cyberattacks,” the report adds. (See report summary)
Federal Insurance Backstop
Federal agencies “have not assessed the extent to which risks to critical infrastructure from catastrophic cyber incidents and potential financial exposures warrant a federal insurance response,” the report states.
GAO states a government study that addresses a federal insurance response should include clear criteria for coverage, specific cybersecurity requirements, and a dedicated funding mechanism with concessions from all market participants.
The report concludes that the Department of the Treasury’s Federal Insurance Office (FIO) and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) should jointly assess the cyberattack risks that warrant a federal insurance response, and inform Congress of the results of their assessment.
The Roundtable’s Homeland Security Task Force discussed the issue of cybersecurity and a potential federal backstop during its June 17 meeting, held in conjunction with The Roundtable’s 2022 Annual Meeting. (Roundtable Weekly, June 17)
The Real Estate Roundtable and Nareit raised concerns to the Securities and Exchange Commission (SEC) about their proposed rules related to cybersecurity risk management, strategy, governance, and incident disclosure. (Comment Letter, May 9)
The letter states that The Roundtable and Nareit generally support the SEC’s efforts to ensure that investors receive accurate and comparable material information regarding company cyber risk management and incidents. (SEC News Release | Proposed Rule | Fact Sheet)
However, the two industry groups expressed a number of concerns arising from the detailed, granular reporting that would be required by the SEC proposal and its rigid incident reporting deadlines, which may unintentionally exacerbate cybersecurity risks for issuers and impose unjustified burdens. Those concerns include:
It is vital to harmonize SEC reporting requirements with other federal and state cyber incident reporting requirements.
The Commission’s proposed 72-hour reporting window should incorporate flexibility for a reporting delay to accommodate other law enforcement and other contingencies.
Registrants should not be required to report detailed descriptions of their internal cybersecurity gameplans, which could compromise them in any number of ways.
The prescriptive requirements for disclosing risk management, strategy, and governance regarding cybersecurity risk are burdensome and unjustified.
The letter also raises concerns about the highly prescriptive nature of the requirements set forth in the Proposal and the “one size fits all” presumption that the prescriptive requirements will be appropriate for all industry sectors.
SEC Climate Disclosure Proposal
A separate SEC proposal on climate disclosure rules has drawn the ire of House Republicans, who have criticized the proposal and called for a hearing with the full commission. (E&E News, May 10)
In a May 4 letter to SEC Chair Gary Gensler, a group of House Republicans led by Oversight and Reform ranking member James Comer (R-KY) stated, “The Climate Disclosure Rule would represent the largest expansion of SEC authority without a clear legislative mandate from Congress.”
A regulatory push on multiple fronts by the Securities and Exchange Commission (SEC) prompted The Real Estate Roundtable and 24 other national business organizations to submit comments to Gensler about the need for more time to assemble meaningful stakeholder analysis as part of the rulemaking process. (Coalition letter, April 5 and Roundtable Weekly, April 8)
The proposed SEC climate disclosure rule hasno immediate effect. If it is finalized, the action could have a significant impact on the real estate industry, requiring all SEC registered companies to report on climate-related risks through annual 10-Ks and additional filings. (SEC News Release | Proposed Rule | Fact Sheet, March 22)
The Securities and Exchange Commission (SEC) on March 9 issued a proposed rule that would require publicly traded companies to disclose a cybersecurity incident within four days of determining a breach is “material,” or important to the average investor. (BGov, March 11 and SEC News Release | Proposed Rule | Fact Sheet)
Proposed SEC Requirements
SEC Chair Gary Gensler, above, said, “Today, cybersecurity is an emerging risk with which public issuers increasingly must contend. I am pleased to support this proposal because, if adopted, it would strengthen investors’ ability to evaluate public companies’ cybersecurity practices and incident reporting.” (Bloomberg, March 9)
An SEC spokesperson noted that the crisis in Ukraine gave these proposals “special relevance.” (CNBC, March 9 and see story below on The Roundtable’s upcoming March 25 discussion on the Ukraine conflict)
The proposed SEC amendments would include requirements around reporting material cybersecurity incidents – and providing periodic updates for previously reported cybersecurity incidents. (Wall Street Journal, March 9)
The proposal also would require periodic reporting related to:
a registrant’s policies and procedures to identify and manage cybersecurity risks;
the registrant’s board of directors’ oversight of cybersecurity risk; and
management’s role and expertise in assessing and managing cybersecurity risk and implementing cybersecurity policies and procedures.
The Real Estate Roundtable is planning to provide comments on the SEC proposal in advance of the May 9, 2022 submission deadline and looks forward to Roundtable members’ input. The proposed four-day reporting timeframe for companies to provide cyber disclosures may not provide enough time for companies to discover the full extent of an incident. (BGov, March 11)
An Audit Analytics report released last year showed the number of cybersecurity intrusions reported by public companies increased from 28 breaches in 2011 to 117 in 2020.
The average cost of a corporate data breach was $4.24 million in 2021, according to an annual IBM Security report.
Separately, the $1.5 trillion omnibus bill spending bill enacted on March 11 included the Cyber Incident Reporting for Critical InfrastructureAct. The legislation establishes a narrower 72-hour window for critical infrastructure owners and operators to disclose a cyberattack to the Cybersecurity and Infrastructure Security Agency (CISA). Certain businesses are also required to report any ransom payments to the federal government within 24 hours, among other changes. (Brownstein Hyatt Farber Schreck, March 14)