Exchange Act Rule 13a-15(a) requires companies to maintain disclosure controls and procedures designed to ensure that information required to be disclosed is accumulated and communicated to management to allow for timely decisions regarding disclosure. The SEC alleged that SolarWinds failed to maintain effective disclosure controls related to material cybersecurity risks and incidents. According to the SEC, SolarWinds maintained an Incident Response Plan (IRP) that contained a classification system. If an incident was classified as a Level 2/moderate incident, the IRP required the incident response team to escalate the incident to those responsible for assessing the company's disclosure obligations. Since SolarWinds was unable to determine the root cause of the USTP and Palo Alto events, both incidents were classified at Level 0, which corresponded to an undetermined security event.