The agency also alleged that the company's "disclosure controls and procedures were not designed to ensure that those responsible for making disclosure determinations were informed of certain information about the circumstances surrounding the breach." The agency's August 16, 2021 cease and desist order recited that, in anticipation that the agency was about to file administrative proceedings, submitted an Offer of Settlement, which the agency accepted. Among other things, the company agreed to take certain remedial steps and pay a $1 million civil money penalty, while at the same time neither admitting nor denying the agency's allegations. Discussion As I noted above, the cease and desist proceeding against Pearson is not the SEC's first cybersecurity related enforcement action. For example, as discussed here, in April 2018, the SEC agreed with Altaba, Yahoo's successor in interest, to settled charges related to disclosures surrounding Yahoo's massive data breach.