Compliance August 9, 2023

New SEC Cybersecurity Rule a ‘Business Problem,’ Not Just IT or Legal, According to Experts

The new disclosure requirements for public companies will require time and resources to meet cybersecurity needs.

Reported by


New cybersecurity rules adopted by the Securities and Exchange Commission last month will require investments in additional training and resources, according to compliance experts who have studied the rule.

Under the new rules, public companies need to disclose significant cybersecurity events within four business days of their discovery and maintain policies and procedures to ensure compliance. The first step for businesses to meet these regulations will be determining if a digital risk is “significant” or not, according to Richard Cooper, the global head of financial services at Fusion Risk Management. To do that, he says, firms must first understand what their business is and what security breaches would be a concern.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

“This isn’t an IT problem; it’s a business problem,” he explains.

Different firms have different priorities, and a regulator such as the SEC does not have insight into the nuances of every business, Cooper notes. The word “significant” is ambiguous, but “it’s ambiguous for your own good,” because the alternative would be the SEC deciding how to run and protect individual businesses.

Cooper gives the example of a bank’s access to cash, loans or key information on their clients and the market being breached or compromised as a “significant event.” But leaks of internal training material, preliminary data or publicly available information probably would not be considered “significant.”

Cooper adds that, for all relevant companies, employee training will be essential. If one department is compromised, then the entire firm only has four days to report it. This means employees will need to be able to recognize an event and know how to report it and to whom. Cooper asks, “Are you confident they will tell you quickly enough?” Companies should therefore focus training efforts on all departments rather than just the IT and legal divisions, he says.

If there is a significant digital event, a firm can request two 30-day extensions, followed by a final 60-day extension, by appealing to the U.S. Attorney General’s office to determine that disclosing the event would compromise national security or public safety, according to the rule.

Helen Christakos, a partner in Allen & Overy LLP, says, “It’s going to be a challenge to get in touch with the AG in that short a window.” She adds that, “there will be something of an art to writing these disclosures” to ensure compliance with the SEC’s rule while not complicating investigations taking place at the state or local level, since those officials do not have the authority to request a postponement of the disclosure.

Speaking of state law enforcement, Christakos recommends that companies “make sure everyone is in the loop and comfortable with what is disclosed,” but that, ultimately, a firm must still comply with the SEC rule.

There is no additional postponement for a significant cybersecurity event after 120 days, according to the rule.

Michael Borgia, a partner in Davis Wright Tremaine LLP, quips that, “after 120 days, it no longer matters what the AG thinks about national security; you have to disclose it.”

 

Data & Research August 8, 2023

BofA: Hardship Withdrawals Up 36% As More Prioritize Short-Term Needs

Distributions were down and hardship withdrawals were up, though overall saving rates remained steady, according to the bank’s latest participant research.

Reported by

Bank of America retirement plan participants’ hardship withdrawals rose 36% year-over-year in Q2 to 0.52% of participants, according to the bank and recordkeeper’s latest participant analysis.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

“This year, more employees are understandably prioritizing short-term expenses over long-term saving,” Lorna Sabbia, head of retirement and personal wealth solutions at Bank of America, said in a statement. “However, it’s critical that employees continue to invest in life’s biggest expense – retirement.” 

In research mining the data of more than 3 million retirement participants released Tuesday, Bank of America found borrowing from workplace plans and hardship withdrawals were both higher this year.

“Regarding the increase in hardships, the economic environment, which has seen higher rates of inflation and cost of living, could certainly be a contributing factor,” Lisa Margeson, Bank of America’s managing director of external affairs for retirement research and insights, said via email. “That said, although the increase in participants taking a hardship seems large, it is still only 0.5% of the total number of 401(k) plan participants.”

Participants also contributed 23% less to retirement plans on average in the year’s second quarter as compared to Q1, the average contribution rate in Q2 was $1,460, down from $1,880 in Q1. While lower for the year, the contribution rate was in line with the same quarter in 2022, which had an average of $1,440.

“There are several factors driving lower dollar contributions, even as savings rates remained consistent,” Margeson wrote. “The 2023 second quarter contribution amount was in line with the same time period last year, so the drop from first quarter may have been influenced by younger participants—presumably with lower salaries—joining plans, as well as the first quarter often being a time when bonuses are awarded.”

On the plus side, the research found that average 401(k) balances were up 9.6% from the end of 2022 to $7,250. In addition, more participants increased their contribution rate than decreased it (10.2% vs. 2.2%) in Q2, led by Generation Z and Millennial employees (19.3% vs. 2.6% and 11% vs. 2.6%, respectively).

“The data from our report tells two stories—one of balance growth, optimism from younger employees and maintaining contributions, contrasted with a trend of increased plan withdrawals,” said Sabbia in a statement.

The bank also revealed findings of about 1 million health savings accounts and financial wellness measures, categories it added to the research this quarter to take a more “holistic look at confidence around financial preparedness,” according to the release.

Through the analysis, the bank found that HSA account balances rose 12% in the first six months of 2022 to $4,397 from $3,931.

The researchers also found that 38% of HSA account holders contributed more than they withdrew year-to-date through Q2, consistent with Q4 2022.

Meanwhile, 72% of HSA account holders used those accounts for health care expenses, and 27% plan to save for the future—a slight increase from the end of 2022, when 24% of account holders intended to maintain the account as savings.

Finally, the bank found a decline in feelings of financial wellness among participants. Out of a possible 100 points, the average financial wellness score for employees was 56, down one point from 57 at year-end. Women trailed men in the category, clocking in with an average score of 52, compared to 59 for men.

«