Podcast: How manufacturers are preparing for cyber incidents and new SEC rules

So if a company isn't paying attention to cybersecurity, now investors are going to know about it.

Second, unless the U.S. Attorney General determines that the disclosure poses a national security or public safety risk, companies must, within four days, disclose cybersecurity incidents that the company determines are material. That's using a new item line on form 8-K. That's the form companies use to report major events that shareholders ought to know about. So now that includes material cybersecurity incidents, incidentally, with material defined as an incident to which there is a substantial likelihood that a reasonable investor would attach importance. And I lied, that is actually quoting something from the SEC. To which there is a substantial likelihood that a reasonable investor would attach importance.

SI: That's a terrific and detailed answer, Dennis. Thank you. Despite your level of detail, these sound like pretty general guidelines, yes?

DS: Here's where things get murky. So what is substantial likelihood? Now, in some cases, like the Clorox breach you mentioned that IndustryWeek reported on last September, there is zero argument that that incident wasn't material because the breach actually affected production. You know, there were severe product shortages on shelves. There was no way profits wouldn't be affected. The stock price actually dropped following when that news broke. It absolutely cost them money and shook investor confidence.

Now, on the other hand, last February, Dole reported a cybersecurity incident after customers in New Mexico and Texas noticed an absence of precut and mixed salad kits on grocery store shelves. So Dole reported it was in the midst of a cyberattack and that slowed its systems down through North America, but also said the effect on operations was minimal. They just put manual operations in place to replace the automated operations and they got things moving again.

So was that actually a material incident if all that happened was customers not being able to purchase a specific product line for a few weeks? How much money does that cost? Maybe not a lot. You know, in the grand scheme of things, I don't know Dole's books, but it maybe doesn't cost a lot. So did they have to report it?

About the Podcast
Great Question: A Manufacturing Podcast offers news and information for the people who make, store and move things and those who manage and maintain the facilities where that work gets done. Manufacturers from chemical producers to automakers to machine shops can listen for critical insights into the technologies, economic conditions and best practices that can influence how to best run facilities to reach operational excellence.

Listen to another episode and subscribe on your favorite podcast app