Skip to main content
CISO Daily
Regulatory Update

SEC's FY2026 Enforcement Results: One Cyber Case, and What the Rest Says About Controls and Disclosure

5 min read
CISO Daily
SEC's FY2026 Enforcement Results: One Cyber Case, and What the Rest Says About Controls and Disclosure

Bottom line: The SEC’s enforcement results for fiscal year 2026 are not a cyber story, and executives should not read them as one. They highlight a single cybersecurity-policy case, but the release as a whole, with two-thirds of standalone actions charging an individual and one section devoted to accounting and disclosure cases, is a reminder of what the regulator pursues when it examines how a company governs and reports. Our assessment: treat cyber governance as part of the same control and disclosure discipline.

What the SEC Published

On 10 November 2026 the SEC released press release 2026-113, summarising results for the fiscal year that ended 30 September. It reports 348 enforcement actions: 235 standalone actions and 113 follow-on administrative proceedings. Total monetary relief ordered was $1.095 billion, made up of $752 million in disgorgement and prejudgment interest and $343 million in civil penalties. The release says a court in a separate, non-SEC action deemed $235 million of the disgorgement satisfied, and that about $731 million was returned to more than 250,000 harmed investors.

Two-thirds of standalone actions included charges against at least one individual, according to the release.

The Cyber Content Is Narrow

Within the release, the cyber-specific item is a settlement with M Holdings Securities, Inc., a dually registered broker-dealer and investment adviser. The SEC says it failed to adopt or maintain reasonably designed policies on cybersecurity, customer information protection and identity theft prevention, citing Regulation S-P and Regulation S-ID.

Two points of scope matter for readers at operating companies:

  • That case involves a regulated financial firm and rules for broker-dealers and advisers. It is not an action under the SEC’s cybersecurity incident disclosure rules for public companies.
  • In the release text we reviewed, the term “SolarWinds” and the phrase “cybersecurity disclosure” do not appear. The release also mentions the New York Stock Exchange settling a Regulation SCI case after it failed to conduct opening auctions for more than 2,800 securities. That is an operational resilience matter for a market operator, not a data security case.

The release also says the Division of Enforcement’s Office of Super Intelligence and Analytics helps address threats “especially in fraud, cyber, and SI-enabled manipulation schemes.” This is a statement about the Division’s tooling and focus, not a new rule or a list of cyber charges.

The Pattern Executives Should Notice

The release covers many kinds of case, including offering frauds, market manipulation and investment-adviser matters. One section covers accounting and disclosure cases. Examples named there in the release include Archer-Daniels-Midland and two former executives settling accounting and disclosure charges, a former CFO of The Bancorp settling charges over a Form 10-K that stated the audit was complete before auditors had given final approval, and Key Tronic Corporation and two senior executives settling books-and-records and internal controls charges tied to false inventory entries.

None of these is a cyber case. What they share with cyber governance is the same underlying questions: who signs off, what evidence supports the statement, and whether controls work as described. Our assessment is that a CISO’s attestations, risk-register entries and incident assessments feed the same sign-off chain.

Credit for Cooperation

The release states that prompt remediation and meaningful cooperation can speed investigations and influence charging and penalty decisions, citing factors including “prompt self-reporting, swift and thorough remediation, and early, proactive engagement with staff.” It notes that CBIZ Inc. received no civil penalty, citing cooperation and remediation, and that Ammo, Inc. received none, citing extensive remedial steps. The release groups Key Tronic with orders imposing no civil penalties; check the order before citing that.

We would not infer a promise of leniency. The release describes factors the Commission weighs, case by case.

Questions for the Next Board or Audit Committee Meeting

These are our suggestions, not SEC requirements.

  1. Is there one sign-off chain? Can the general counsel, CFO and CISO show how a cyber statement in a filing, such as a material incident assessment, was evidenced and approved?
  2. Do our written policies match practice? The M Holdings case turned on whether policies were reasonably designed and maintained. Ask for a recent test of a safeguards or identity-theft policy against what teams actually do. This applies most directly if you operate a regulated financial entity.
  3. Is our escalation fast enough to self-report? The release treats early engagement as relevant. Check that the path from detection to a legal decision on disclosure is rehearsed and documented.
  4. Where does individual accountability sit? With most standalone actions naming individuals, confirm that executives understand which attestations carry their names.

For the incident disclosure rules themselves, see our guide to SEC cybersecurity disclosure rules.

What We Have Not Confirmed

This briefing relies on the SEC press release alone. We have not reviewed the individual orders and complaints behind each case, so detail on the M Holdings settlement, including any penalty, should be checked against the order before it is cited.

Sources