Subject: File No. S7-09-22
From: Tessa Mishoe
Affiliation: Senior Threat Researcher

March 10, 2022

The importance of rules regarding risk management and breach disclosure is incredibly important to public trading and the security of the United States as a whole.

Private companies carry a lot of important personal information that can easily be used to wreak havoc upon individual citizens, the companies they work for, the organizations they interact with, and the government they live under.

Breaches are exceedingly dangerous and can lead to the complete upending of livelihood for all people in all classes. The question of whether a company will be breached is typically 'when' and not 'if', as 74% of 664 respondents surveyed from large companies confirmed that they had experienced a data breach before. (https://www.statista.com/statistics/1280029/companies-experiencing-data-breach-can-us/#::text=Share of companies experiencing a,U.S. and Canada 2020-2021text=In 2021, 74 percent of,had experienced a data breach.)


The easiest prevention of further breaches is proactivity. Risk management disclosure encourages enterprises to show greater attention to their risk policies. Requiring breach disclosures makes the idea of breaches unsavory for public relations, making risk less savory as well and further protecting personally identifiable information of customers and partners.

In total, the fewer breaches that happen, the better. The less information on U.S. citizens that reaches the hands of external threat actors, the better chance we have in the worldwide cybersecurity field.