A New York federal district judge handed down a significant decision dismissing much of the SEC’s securities fraud enforcement action against SolarWinds arising from its claims relating to SolarWinds’ cybersecurity policies and disclosure of a significant cyberattack against the SolarWinds’ network.
In this episode of Corruption, Crime, and Compliance, Michael Volkov discusses the significant dismissal of most of the SEC’s securities fraud claims against SolarWinds by a New York federal district court.
The case highlights the ongoing challenges in balancing cybersecurity disclosures with regulatory requirements and the implications this ruling might have for future SEC enforcement actions.
You’ll hear him discuss:
- Judge’s Decision: The court ruled that the SEC’s claims were overly reliant on hindsight and speculation, particularly regarding SolarWinds’ early-stage disclosure during the investigation of cyber incidents.
- Pre- and Post-Sunburst Disclosures: While the court upheld charges related to SolarWinds’ pre-Sunburst cybersecurity statements, it dismissed the SEC’s claims about the company’s post-Sunburst disclosures, finding them not misleading under the circumstances.
- Internal Controls vs. Cybersecurity: The court rejected the SEC’s attempt to apply internal accounting controls provisions to cybersecurity policies, marking a significant limitation on the SEC’s enforcement scope.
- Implications for SEC’s Approach: This decision contradicts the SEC’s previous stance in cases like R.R. Donnelly, potentially influencing future SEC actions regarding cybersecurity and internal controls.
- Broader Impact: The ruling may affect how cybersecurity risks are reported and how companies manage their disclosure obligations, particularly in light of potential appeals and further litigation by the SEC.
Resources:
