With the US Securities and Exchange Commission (SEC) having taken legal action against CISOs at both SolarWinds and Uber, security executives feel the pressure to be absolutely precise when writing up security incidents that the company has decided are material. Things get tricky because even if the CISO’s report is perfect, someone up the line-the CEO, the CFO, general counsel, or even a board member-might make a change that the SEC finds problematic and possibly fraudulent.
