Introduction

Recently, the Securities and Exchange Commission (“SEC”) filed a complaint in the Southern District of New York against the SolarWinds Corporation, a network and infrastructure management company, and also named the company’s Chief Information Security Officer as an individual in the action. The SEC’s complaint alleges that the defendants defrauded investors and customers through internal control failures, as well as a series of misstatements, omissions, and schemes that obscured SolarWinds’ deficient cybersecurity practices and the cybersecurity threats it was facing. The SEC alleges the disclosure deficiencies violated the antifraud provisions of the Securities Act of 1933 and of the Securities Exchange Act of 1934, and the control failures violated the reporting and internal control provisions of the Exchange Act. Finally, while the SEC has recently issued cybersecurity rules that will come into effect in December, these allegations are all founded on existing regulations that do not invoke the requirements of the new rules. We summarize the case below and suggest a number of precautions companies can take in contemplation of this more aggressive SEC posture regarding cybersecurity compliance.