And in 2023, the SEC charged SolarWinds and its Chief Information Security Officer for fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities – although that case was significantly cut back by the district court following the defendants' motion to dismiss, which included dropping the internal controls charges.1 There has also been further implementation of the SEC's rules requiring public companies to disclose material cybersecurity incidents and information regarding their cybersecurity risk management, strategy, and governance, which took effect in December 2023. (Ropes & Gray covered these rules in detail here). As such, this year is likely to be another active one for the Enforcement Division's Crypto Assets and Cyber Unit.