SEC Cybersecurity Compliance for Investment Firms & Public Companies
Four business days is not much time. Be ready before the clock starts.
Assess Your SEC ReadinessOverview
The SEC cybersecurity rules changed what investment firms and public companies must say, and how fast. A material incident must be disclosed on Form 8-K within four business days of determining materiality, and every 10-K must describe how cyber risk is managed and governed.
DeBerry Contracts helps leadership, legal, and security teams work from the same playbook. We build materiality frameworks, tighten the controls behind your disclosures, and prepare the board-level reporting that Item 106 requires.
Challenges We Solve
- Materiality decisions require security, legal, finance, and executives to agree quickly under pressure.
- Item 106 disclosures must accurately describe processes that are often undocumented.
- Board members need cybersecurity briefings they can understand and act on.
- Third-party and vendor risk must be overseen and described in annual filings.
What We Do
Materiality Assessment Playbook
A pre-approved framework, decision log, and disclosure committee charter so materiality calls are fast and defensible.
Incident Disclosure Readiness
Tabletop exercises that walk executives through a realistic incident from detection to 8-K filing.
Item 106 Program Documentation
Document your risk management, strategy, and governance processes so annual disclosures are accurate and consistent.
Board Cybersecurity Reporting
Quarterly dashboards and briefings that translate technical risk into business impact.
Third-Party Risk Management
Vendor tiering, security questionnaires, and contract terms for providers that touch critical systems.
SOX IT General Controls
Access, change management, and logging controls that support accurate financial reporting.
Who We Serve
Investment Management Firms
Asset managers, private equity, and fund advisers
Broker-Dealers
Firms subject to Regulation S-P and SEC examination
Public Companies
Issuers filing 8-K and 10-K cybersecurity disclosures
Pre-IPO Companies
Organizations building controls ahead of going public
Frequently Asked Questions
Let's Connect
Talk with a specialist about your investment firms & public companies needs.
Assess Your SEC Readiness Sales@deberrycontracts.comMore Financial Services
SEC and SOX Requirements, Section by Section
Every requirement, what it means for your systems, and the quick win that gets you there faster. Open any section to see the details.
SEC Cybersecurity Disclosure Rules & Regulation S-P
The SEC expects firms to detect incidents fast, decide materiality without delay, and prove that cybersecurity is governed from the board down. We build the playbooks, controls, and evidence that make those deadlines achievable.
- Determine whether an incident is material without unreasonable delay after discovery.
- File an 8-K within four business days of a materiality determination.
- Describe the nature, scope, and timing of the incident and its material or reasonably likely impact.
- Amend the filing as information that was unavailable at the time becomes known.
Stand up a disclosure committee and a pre-approved materiality worksheet so the four-day clock never starts from zero.
- Describe processes for assessing, identifying, and managing material cybersecurity risks.
- Disclose whether third-party assessors, consultants, or auditors are engaged.
- Explain how risks from third-party service providers are overseen.
- Describe board oversight and the expertise of management responsible for cybersecurity.
Map your security program to NIST CSF 2.0 and document board briefings quarterly so the annual narrative writes itself.
- Maintain a written incident response program to detect, respond to, and recover from unauthorized access to customer information.
- Notify affected individuals as soon as practicable, and no later than 30 days after becoming aware of a breach of sensitive customer information.
- Oversee service providers, including requiring them to notify you within 72 hours of a breach.
- Keep records demonstrating compliance with safeguards and disposal requirements.
Add a 72-hour breach notice clause to every vendor contract and keep a ready-to-send customer notification template.
Sarbanes-Oxley IT Security Requirements by Section
Sarbanes-Oxley is a financial reporting law, but nearly every section depends on IT controls. Here is what each section means for your systems, and the fastest way to get audit-ready.
- Access controls so only authorized personnel can modify financial data.
- Logging and monitoring to track changes to financial reports and data.
- Data integrity checks such as checksums or hashing to prove data has not been altered.
Enable Microsoft Purview audit logging and restrict finance system admin rights to named individuals.
- Encrypted transmission for financial data shared with external parties.
- Data classification policies that identify and protect sensitive financial information.
- Regular review of security policies to keep pace with disclosure requirements.
Apply sensitivity labels to financial workbooks so encryption follows the file wherever it goes.
- Regular risk assessments of IT systems that handle financial data.
- Multi-factor authentication on every system that accesses financial data.
- Documented IT controls, including formal change management.
- Periodic testing of control effectiveness with documented results.
Enforce MFA through Entra ID Conditional Access and keep a single control matrix your auditor can test against.
- Real-time monitoring to detect unauthorized access or changes to financial data.
- Secure, redundant disclosure systems that prevent downtime.
- Secure communication channels for urgent disclosures.
Route finance-system alerts into a monitored queue with a defined escalation owner.
- Data retention policies that define how long financial records are kept.
- Data loss prevention to stop unauthorized deletion or alteration.
- Backups that can recover from accidental or malicious deletion.
Configure Microsoft 365 retention policies and immutable backups for finance mailboxes and SharePoint sites.
- Secure, anonymous reporting channels that protect the reporter’s identity.
- Access to whistleblower reports restricted to authorized personnel.
- Regular audits of the reporting process for effectiveness and security.
Use a dedicated third-party hotline and lock its admin access to the audit committee.
- Controls that prevent unauthorized access to audit data and documents.
- Secure audit trails tracking access and changes to financial records.
- Secure, read-only auditor access that preserves data integrity.
Provision auditors as time-limited guest accounts with read-only access to a dedicated evidence site.
- Controls ensuring the accuracy and completeness of financial reports.
- Encryption of sensitive financial data at rest and in transit.
- Security policies updated as reporting requirements change.
Pair BitLocker device encryption with TLS-only mail flow to cover data at rest and in transit.
Ready to Get Started?
Four business days is not much time. Be ready before the clock starts.