Tag: Cyber Risks

Real Estate Coalition Raises Concerns Over Cyber Reporting Requirements

Posted on by Abigail Grenadier

A coalition of national real estate associations submitted comments to the Cybersecurity and Infrastructure Security Agency (CISA) expressing concerns over a new proposed rule: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements. As currently drafted, the rule imposes overly burdensome requirements and requires companies to assume unnecessary but significant legal and cybersecurity risks. (Letter)

Cyber Incident Reporting Rule

  • Under the current proposal, companies would be required to report significant cyber incidents to the Department of Homeland Security or CISA within 72 hours as well as any ransomware payments within 24 hours.
  • Given the ever-expanding cyber-threat landscape, the rental housing and real estate industry has prioritized defense against vulnerabilities.
  • The industry has undertaken efforts to mitigate cybersecurity risks, implement policies to prevent and mitigate such risks and encourage investments in bolstering cyber defenses to protect data.

  • The letter noted, “We support a unified but flexible regulatory framework for data security and incident notification, and believe it is important to have a balanced approach to providing consumers with meaningful information about material cybersecurity risks and incidents, while also not imposing overly burdensome regulations on the real estate/rental housing industry or unintentionally exposing our members to substantially greater cybersecurity risks.”

Industry Concerns and Recommendations

  • Overly burdensome requirements: CISA should revise the definition of “covered cyber incident” to a higher threshold for reporting to prevent unnecessary administrative load.
  • Disproportionate compliance costs: the estimated compliance cost of over $1.4 billion is seen as disproportionate to the benefits. These funds could be better spent on actual cybersecurity measures rather than on reporting.
  • Reporting deadlines are unclear and increase the risk of attack: the proposed rule’s 72-hour reporting requirement and 24-hour ransom payment reporting deadline could hinder effective incident response and increase vulnerability to additional attacks.
  • The proposed rule adds another reporting requirement to an already cluttered landscape. CISA should harmonize its reporting requirements to reduce compliance burdens.

The Real Estate Roundtable’s Homeland Security Task Force and RE-ISAC will continue to be resources and assist CISA in the development of clear, effective, and secure cyber incident reporting rules.

SEC Issues Final Cybersecurity Disclosure Rules for Public Companies

Posted on by Trey Jackson
SEC Cyber Disclosure

The Securities and Exchange Commission (SEC) finalized new rules last week by a vote of 3-2 that will require public companies to disclose more information about cybersecurity-related incidents, risk management, strategy, and governance. A joint comment letter by The Real Estate Roundtable and Nareit about the SEC proposal was cited nearly a dozen times in the final rule. (SEC fact sheet | Roundtable-Nareit comment letter, May 9, 2022)

Industry Objections

  • The Roundtable and Nareit expressed a number of concerns in their May 2022 letter about the proposed rule’s rigid incident reporting deadlines and granular requirements, which the industry organizations stated may unintentionally exacerbate cybersecurity risks for issuers while imposing unjustified burdens. (Roundtable Weekly, May 13, 2022)
  • Under the new rules, registered companies must report cyber-attacks by filing an 8-K form with the SEC within four business days, which The Roundtable and Nareit objected to in their joint letter.
  • Responding to these concerns, the SEC stated in its final rule that it is “… providing for a delay for disclosures that would pose a substantial risk to national security or public safety, contingent on a written notification by the Attorney General, who may take into consideration other Federal or other law enforcement agencies’ finding.” (Pensions and Investments, July 26)
  • The SEC also responded to industry concerns by stating it had “streamlined” its requirements on cyber-attack disclosures to focus more on the potential effects, rather than the details of the incident itself. (Wall Street Journal, July 26 | PillsburyLaw and GreenbergTaurig)
  • The agency states in its final rule, “To that end, to balance investors’ needs with the concerns raised by commenters …The final rules will require the registrant to describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.”
  • SEC Chairman Gary Gensler emphasized that the final rule does not require disclosure of non-material information related to incidents—unlike the original proposal issued in March 2022. (SEC news release, July 26, 2023 and Roundtable Weekly, March 18, 2022)

New Disclosures Required

Federal Register
  • Public real estate companies will also be required to disclose the board of directors’ oversight of cybersecurity threats, identify any board committee (or subcommittee) responsible for cybersecurity oversight, and the processes by which the board or (sub) committee is informed about these risks.
  • The final SEC rule will become effective on September 5, according to a notice today in the Federal Register. All registered public companies, other than smaller reporting companies, must begin complying by Dec. 18, 2023.

The Roundtable’s Homeland Security Task Force will remain engaged with government officials and private sector partners on industry best practices to detect, protect, and respond to a variety of key threats, including cyber-attacks.

#  #  #

Senate Bill Introduced to Require Federal Guidance on Cybersecurity Insurance

Posted on by Trey Jackson

Cybersecurity graphic - image

Federal guidance on cyber insurance policies is the focus of a new bipartisan Senate bill introduced on Feb. 21 that aims to protect businesses and consumers against cyberattacks. (PoliticoPro, Feb. 21)

Cyber Issues

  • The Insure Cybersecurity Act will direct the National Telecommunications and Information Administration (NTIA) to mitigate digital risk by developing recommendations for issuers, agents, brokers, and customers to improve communication over cybersecurity insurance coverage levels.
  • Co-sponsored by Sens. John Hickenlooper (D-CO) and Shelley Moore Capito (R-WV), the bill also directs a NTIA task force to develop policy recommendations relating to ransomware or ransom payments, and the “terminology used in policies to include or exclude losses” due to cyber terrorism or acts of war.
  • Hickenlooper is the new chair of the Commerce Committee’s Subcommittee on Consumer Protection, Product Safety, and Data Security.
  • A 2021 Government Accountability Office report found that ambiguity in policy language can result in misunderstandings and litigation between issuers and policyholders—and underestimations of coverage needed to protect against cyber risks.

The Roundtable’s Homeland Security Task Force continues working with the Real Estate Information Sharing and Analysis Center (RE-ISAC), federal officials, and real estate companies about threats to the business cyber environment with the aim of mitigating cyber intrusions.

#  #  #

Fed Reports U.S. Financial Stability Risks Include Inflation, Asset Valuation Pressures, and Cyber Attacks

Posted on by Trey Jackson

The Federal Reserve in Washington, DC

Near-term risks to the U.S. economy and financial system include inflation, asset valuation pressures and cyber attacks, according to the Federal Reserve’s semiannual Financial Stability Report released this month. (Wall Street Journal, Nov. 4)

Stability Threats

Fed Report Risks Nov 2022

  • “Higher-than-expected interest rates could lead to increased volatility in financial markets, stresses to market liquidity, and declines in asset prices, including prices of both commercial and residential real estate properties,” the central bank states in its report.
  • The report warns that such effects could cause losses at a range of financial intermediaries, reducing their access to capital and raising their funding costs—and pose adverse consequences for asset prices, credit availability, and the economy.
  • Federal Reserve Vice Chair Lael Brainard stated the American financial system has held up through the turbulent developments of the past year. She said, “Household and business indebtedness has remained generally stable, and on aggregate households and businesses have maintained the ability to cover debt servicing, despite rising interest rates.”

Cybersecurity Concerns

Financial Risks Chart - Federal Reserve

  • Respondents to the central bank’s survey on stability threats also noted continuing concerns about the Russian invasion of Ukraine, high oil prices and a potential conflict between China and Taiwan. Cyber attacks pose an additional risk that “could come as retaliation for sanctions imposed on Russia,” according to the Fed’s report.
  • The Roundtable’s Homeland Security Task Force will hold a conference call on Monday, November 28 that will focus on a new Cyber Risk Summary briefing on Commercial Facilities—includes Commercial Real Estate—from the Cybersecurity and Infrastructure Security Agency (CISA). [To register, contact Andy Jabbour of the Real Estate Information and Sharing Network (RE-ISAC)]
  • U.S. financial institutions processed approximately $1.2 billion in ransomware-related payments last year, a nearly 200 percent increase compared to 2020, according to the Treasury Department’s Financial Crimes Enforcement Network. (FinCEN report, Nov. 1)

Cybersecurity issues and CRE will be discussed during the next HSTF meeting on Jan. 25, 2023—held in conjunction with The Roundtable’s State of the Industry meeting. (Roundtable Weekly, Oct. 7)

#  #  # 

Treasury and CISA Seek Comments on Potential National Cyber Insurance Program

Posted on by Trey Jackson

CISA LogoAs cyberattacks pose an increasing threat to the real estate industry and the U.S. economy, the government is seeking input from policyholders, critical infrastructure owners, and operators on a potential federal response for catastrophic cyber incidents, including whether a national cyber reinsurance program is warranted. (Treasury Department Notice, Sept. 29 and NextGov, Sept. 28)

Response to Catastrophic Cyber Attacks

Terrorism & Cybersecurity

CIAT logo

  • The Roundtable and its partners in the Coalition to Insure Against Terrorism (CIAT) have raised concerns about the need for effective insurance products to help manage the risks of catastrophic cyberattacks. (CIAT comment letter on the 2022 Report on the Effectiveness of the Terrorism Risk Insurance, May 16)
  • Insurers and the federal government’s Terrorism Risk Insurance Program (TRIP) may not cover the expanding range of such losses. For example, TRIP may only cover cyberattacks if they can be considered “terrorism” under its defined program criteria. (Roundtable Weekly, June 24)
  • Separately, CISA is requesting input on the implementation of cyber incident reporting requirements (due Nov. 14). CISA is also hosting a series of public listening sessions in cities throughout the nation as an additional means of gathering stakeholder responses on definitions for the proposed rules, the form and content of reports, enforcement procedures, and information protection policies. (Federal Register and Notice of Public Listening Sessions, Sept. 12)

Cybersecurity has long been a focus of The Roundtable’s Homeland Security Task Force (HSTF) and the Real Estate Information Sharing and Analysis Center. Cybersecurity issues and CRE will be discussed during the next HSTF meeting on Jan. 25, 2023—held in conjunction with The Roundtable’s State of the Industry meeting. (Roundtable Meeting Calendar)

#  #  # 

GAO Recommends Government Assessment of Federal Backstop for Catastrophic Cyberattacks

Posted on by Trey Jackson

GAO cyber study cover

The US Government Accountability Office (GAO) recommended in a June 21 report that the federal government should assess the need for a potential insurance backstop for cyberattacks on critical infrastructure. (GAO summary “Cyber Insurance: Action Needed to Assess Potential Federal Response to Catastrophic Attacks”)

Growing Cyber Threats

cyber attack image

  • With the growing proliferation of cyberattacks, the challenge of mitigating and managing this expanding risk poses an increasing challenge to the U.S. economy and real estate.
  • Insurers and the government’s terrorism risk insurance program originally established under the Terrorism Risk Insurance Act (TRIA) may not be able to cover the expanding range of such losses. For example, TRIA may only cover cyberattacks if they can be considered “terrorism” under its defined program criteria.
  • TRIA was reauthorized in 2019 and extended for seven years through 2027. The legislation included a request for a study on evolving cyber terrorism risks. (Coalition to Insure Against Terrorism)
  • The Roundtable has raised concerns about the need for policyholders to have access to effective insurance products to help manage the risks of catastrophic cyberattacks—particularly in the context of TRIA-backed coverage for cyber terrorism attacks. (See May 16, 2022 joint comment letter on “2022 Report on the Effectiveness of the Terrorism Risk Insurance Program”)
  • This month’s GAO report acknowledges that although some cyber incident costs are covered in part by the private cyber insurance market, growing cyber threats have created uncertainty in this evolving market.
  • The report also notes that cyber incidents can spill over from the initial target to economically linked firms, thereby magnifying damage and threats to the overall economy. “Cyber insurance and the Terrorism Risk Insurance Program (TRIP)—the government backstop for losses from terrorism—are both limited in their ability to cover potentially catastrophic losses from systemic cyberattacks,” the report adds. (See report summary)

Federal Insurance Backstop

CISA Logo

  • Federal agencies “have not assessed the extent to which risks to critical infrastructure from catastrophic cyber incidents and potential financial exposures warrant a federal insurance response,” the report states.
  • GAO states a government study that addresses a federal insurance response should include clear criteria for coverage, specific cybersecurity requirements, and a dedicated funding mechanism with concessions from all market participants.
  • The report concludes that the Department of the Treasury’s Federal Insurance Office (FIO) and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) should jointly assess the cyberattack risks that warrant a federal insurance response, and inform Congress of the results of their assessment.

The Roundtable’s Homeland Security Task Force discussed the issue of cybersecurity and a potential federal backstop during its June 17 meeting, held in conjunction with The Roundtable’s 2022 Annual Meeting. (Roundtable Weekly, June 17)

#  #  # 

Roundtable and Nareit Raise Concerns to SEC About Proposed Cybersecurity Rules; SEC Climate Proposal Stokes GOP Criticism

Posted on by Trey Jackson

Cybersecurity computer operator at console with world map

The Real Estate Roundtable and Nareit raised concerns to the Securities and Exchange Commission (SEC) about their proposed rules related to cybersecurity risk management, strategy, governance, and incident disclosure. (Comment Letter, May 9)

Industry Concerns

  • The letter states that The Roundtable and Nareit generally support the SEC’s efforts to ensure that investors receive accurate and comparable material information regarding company cyber risk management and incidents. (SEC  News Release |  Proposed Rule |  Fact Sheet)
  • However, the two industry groups expressed a number of concerns arising from the detailed, granular reporting that would be required by the SEC proposal and its rigid incident reporting deadlines, which may unintentionally exacerbate cybersecurity risks for issuers and impose unjustified burdens. Those concerns include:
  • It is vital to harmonize SEC reporting requirements with other federal and state cyber incident reporting requirements.
  • The Commission’s proposed 72-hour reporting window should incorporate flexibility for a reporting delay to accommodate other law enforcement and other contingencies.
  • Registrants should not be required to report detailed descriptions of their internal cybersecurity gameplans, which could compromise them in any number of ways.
  • The prescriptive requirements for disclosing risk management, strategy, and governance regarding cybersecurity risk are burdensome and unjustified.
  • The letter also raises concerns about the highly prescriptive nature of the requirements set forth in the Proposal and the “one size fits all” presumption that the prescriptive requirements will be appropriate for all industry sectors.

SEC Climate Disclosure Proposal

logo - U.S. Securities and Exchange Commission

  • A separate SEC proposal on climate disclosure rules has drawn the ire of House Republicans, who have criticized the proposal and called for a hearing with the full commission. (E&E News, May 10)
  • In a May 4 letter to SEC Chair Gary Gensler, a group of House Republicans led by Oversight and Reform ranking member James Comer (R-KY) stated, “The Climate Disclosure Rule would represent the largest expansion of SEC authority without a clear legislative mandate from Congress.”
  • A regulatory push on multiple fronts by the Securities and Exchange Commission (SEC) prompted The Real Estate Roundtable and 24 other national business organizations to submit comments to Gensler about the need for more time to assemble meaningful stakeholder analysis as part of the rulemaking process. (Coalition letter, April 5 and Roundtable Weekly, April 8)

The proposed SEC climate disclosure rule has no immediate effect. If it is finalized, the action could have a significant impact on the real estate industry, requiring all SEC registered companies to report on climate-related risks through annual 10-Ks and additional filings. (SEC  News Release |  Proposed Rule |  Fact Sheet, March 22)

#  #  #

SEC Proposes 4-day Cybersecurity Reporting Requirements for Public Companies; Roundtable’s HSTF Plans Security Threat Briefings

Posted on by Trey Jackson

Gary Gensler of the SEC

The Securities and Exchange Commission (SEC) on March 9 issued a proposed rule that would require publicly traded companies to disclose a cybersecurity incident within four days of determining a breach is “material,” or important to the average investor. (BGov, March 11 and SEC News Release | Proposed Rule | Fact Sheet)

Proposed SEC Requirements

  • SEC Chair Gary Gensler, above, said, “Today, cybersecurity is an emerging risk with which public issuers increasingly must contend. I am pleased to support this proposal because, if adopted, it would strengthen investors’ ability to evaluate public companies’ cybersecurity practices and incident reporting.” (Bloomberg, March 9)
  • An SEC spokesperson noted that the crisis in Ukraine gave these proposals “special relevance.” (CNBC, March 9 and see story below on The Roundtable’s upcoming March 25 discussion on the Ukraine conflict)
  • The proposed SEC amendments would include requirements around reporting material cybersecurity incidents – and providing periodic updates for previously reported cybersecurity incidents. (Wall Street Journal, March 9)
  • The proposal also would require periodic reporting related to:
    • a registrant’s policies and procedures to identify and manage cybersecurity risks;
    • the registrant’s board of directors’ oversight of cybersecurity risk; and
    • management’s role and expertise in assessing and managing cybersecurity risk and implementing cybersecurity policies and procedures.
  • The Real Estate Roundtable is planning to provide comments on the SEC proposal in advance of the May 9, 2022 submission deadline and looks forward to Roundtable members’ input. The proposed four-day reporting timeframe for companies to provide cyber disclosures may not provide enough time for companies to discover the full extent of an incident. (BGov, March 11)

Cybersecurity Threats

Cybersecurity computer operator at console with world map

  • An Audit Analytics report  released last year showed the number of cybersecurity intrusions reported by public companies increased from 28 breaches in 2011 to 117 in 2020.
  • The average cost of a corporate data breach was $4.24 million in 2021, according to an annual IBM Security report.
  • Separately, the $1.5 trillion omnibus bill spending bill enacted on March 11 included the Cyber Incident Reporting for Critical Infrastructure Act. The legislation establishes a narrower 72-hour window for critical infrastructure owners and operators to disclose a cyberattack to the Cybersecurity and Infrastructure Security Agency (CISA). Certain businesses are also required to report any ransom payments to the federal government within 24 hours, among other changes. (Brownstein Hyatt Farber Schreck, March 14)

REISAC logo

  • The Real Estate Roundtable’s Homeland Security Task Force (HSTF) is coordinating briefings on the following security threats through the Real Estate Information Sharing and Analysis Center (RE-ISAC):
    • April: DHS Sector Outreach and Programs (Active Shooter, and other soft target resources for the Commercial Facilities Sector)
    • May: DHS Fusion Center overview
    • June: US Secret Service cybercrime
    • August: The Protective Security Advisor Program
    • September: FBI cybersecurity/cybercrimeNovember: The InfraGard program 

Roundtable members interested in participating can contact Andy Jabbour of the RE-ISAC. 

#  #  #