The U.S. Securities and Exchange Commission (SEC) Human Capital Management Disclosure (HCM Disclosure) is a proposed rule that has yet to be finalized or officially implemented. However, there's ongoing discussion and industry preparation for its potential future adoption. Here's how the HCM Disclosure, if implemented, might play a role in security, cybersecurity, and risk management:

Increased Transparency in Workforce Management:

• The proposed HCM Disclosure aims to mandate that publicly traded corporations provide additional details regarding their human capital management (HCM) strategy. It might contain information about:

• Workforce composition: Number of full-time, part-time, and contingent workers.

• Talent acquisition and retention strategies: Data on employee turnover, training programs, and diversity, equality, and inclusion (DE&I) initiatives are a few examples of what this could entail.

Indirect Impact on Security and Risk Management:

• While not directly focused on cybersecurity, the HCM Disclosure could have some indirect implications for security and risk management:

• Cybersecurity Awareness Training: The disclosure might encourage companies to detail their efforts in training employees on cybersecurity best practices. A robust cybersecurity culture within the workforce can deter social engineering attacks and phishing attempts.

• Workforce Stability and Risk Mitigation: High employee turnover can be disruptive and potentially lead to security vulnerabilities. By encouraging transparency in talent retention strategies, the disclosure could indirectly promote practices that contribute to a more stable and security-conscious workforce.

Limited Direct Impact on Third-Party and Supply Chain Security:

• The proposed HCM Disclosure is primarily focused on a company's internal workforce. It's unlikely to address third-party or supply chain security in detail directly.

Integration with Broader Risk Management Framework:

• The information gleaned from the HCM Disclosure, even if not directly related to cybersecurity, could be integrated with a broader risk management framework. It can provide a more holistic view of potential risks associated with the workforce and how they might indirectly impact cybersecurity posture.

Future of HCM Disclosure:

• The SEC is still considering the proposed HCM Disclosure rule. If implemented, it's likely to evolve. The specific details of the final rule will determine the exact impact on security and risk management practices.

Current Landscape:

• Without a formal HCM Disclosure requirement, some companies already choose to disclose information about their human capital management practices in their annual reports or sustainability reports.

The SEC's proposed HCM Disclosure could indirectly affect security and risk management by promoting a more secure and stable workforce. However, it wouldn't directly address cybersecurity or third-party risk management. Regardless of the final ruling, organizations can benefit from proactively considering how their human capital management practices contribute to their overall security posture.

While the SEC's HCM Disclosure is still a proposal, ThreatNG can be a valuable solution for organizations to prepare for potential future requirements. Here's how it can help discover and evaluate information relevant to HCM, even without a formal mandate:

Monitoring News and Social Media:

• Sentiment Analysis: ThreatNG can monitor news articles, social media discussions, and employee review platforms for mentions of the company and its HCM practices. It can provide insights into employee sentiment regarding training opportunities, work culture, and potential security concerns.

• Layoff Chatter Detection: ThreatNG can identify discussions about layoffs or workforce reductions. High employee turnover can be disruptive and potentially lead to security vulnerabilities. Early detection can trigger investigations into the reasons behind the turnover and potentially mitigate security risks.

Correlation with Existing Security Practices:

• Security Awareness Training Analysis: By monitoring employee discussions and sentiment on social media, ThreatNG might indirectly identify gaps in cybersecurity awareness training. It can inform improvements to existing training programs to create a more security-conscious workforce.

• Workforce Stability and Phishing Risk: ThreatNG can correlate periods of high employee turnover with phishing attempts. Disgruntled or departing employees might be more susceptible to social engineering attacks. Identifying this correlation can inform targeted phishing awareness campaigns.

Integration with Complementary Solutions:

• Security Information and Event Management (SIEM): ThreatNG's insights on employee sentiment and potential security concerns can be integrated with SIEM to identify potential insider threats or areas where security policies might need adjustments.

• Governance, Risk, and Compliance (GRC): Information on employee sentiment and potential security risks gleaned from social media monitoring can be fed into GRC platforms. It allows for evaluating if current practices comply with industry best practices and internal policies related to workforce management and security.

• Risk Management Solutions: Risk management solutions can use ThreatNG's insights to create a more holistic risk profile that considers potential security risks associated with workforce instability or low morale.

Examples:

• Identifying Potential Security Risks: ThreatNG detects a surge in employee complaints on social media regarding a lack of cybersecurity awareness training. This information can address the training gaps and potentially reduce the risk of successful phishing attacks.

• M&A Due Diligence: ThreatNG can analyze social media chatter and news articles to assess the target company's work culture and potential employee dissatisfaction. A high turnover rate or negative sentiment could indicate a less security-conscious workforce, increasing the acquisition's overall risk profile.

• Proactive Workforce Management: ThreatNG finds press articles mentioning a rival company making significant layoff announcements. It may force the company to reevaluate its methods for retaining talent and pinpoint areas in which they might be strengthened to reduce the security concerns brought on by employee churn.

ThreatNG Advantage

ThreatNG provides a central platform for monitoring various sources (news, social media, SEC filings) without a formal HCM Disclosure requirement.

• Actionable Insights: By analyzing sentiment and correlating data from various sources, ThreatNG provides actionable insights to improve workforce management practices and potentially enhance security posture.

• Future-Proof Approach: ThreatNG positions organizations to adapt seamlessly if the HCM Disclosure is implemented, as it already can gather relevant data.

Current Best Practices:

• Even without a formal HCM Disclosure, organizations can benefit from proactively monitoring public discussions about their workforce practices. ThreatNG can be a valuable tool in this process.

While the SEC HCM Disclosure is still a proposal, ThreatNG can be valuable for organizations preparing for potential future requirements and proactively managing workforce-related security risks. By monitoring public discussions and sentiment analysis, ThreatNG can provide insights to improve human capital management practices and contribute to a more secure work environment.