1. What are High-Impact Controls?

Under COSO 2013 and NIST CSF 2.0, controls are prioritized by:

Legal Duty: Section 404(a) of Sarbanes-Oxley requires all public companies to assess and report on design and operating effectiveness of internal control over financial reporting. SOX Section 302 requires CEO and CFO to personally certify every report that signing officers are responsible for establishing and maintaining internal controls, have evaluated those controls within 90 days, and have disclosed all significant deficiencies and material weaknesses.

SEBI LODR Reg 17(8) and Companies Act Sec 134(5)(e) impose same duty in India - Directors Responsibility Statement must state internal financial controls are adequate and operating effectively.

Failure to prioritize = You certified controls are effective but you never tested high-impact controls.

2. Legal Framework - When Prioritization Failure = Liability

A. Delaware Caremark Standard - Gold Standard for Directors Liability

In data breach actions, directors can be personally liable for failing to "appropriately monitor and supervise the enterprise."

Two-prong test from In re Caremark International Inc. Derivative Litigation (1996) as clarified in Stone v. Ritter (2006):

1. Directors utterly failed to implement any reporting or information system or controls; OR
2. Having implemented, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks.

If you prioritized low-impact controls and left high-impact controls unimplemented, you fail prong 1.

B. SEC - Internal Accounting Controls - Sec 13(b)(2)(B)

Failure to devise and maintain appropriate internal accounting controls is itself a violation, even without fraud.

3. Leading Case Laws

A. Financial Reporting - SOX 404 Failures

1. SEC v. PACCAR Inc., Civil Action No. 2:13-cv-00953 (W.D. Wash. Filed June 3, 2013)
The SEC brought unusual case in which alleged violations related principally to failure to maintain adequate internal control over financial reporting.

Facts: PACCAR, commercial truck manufacturer, had errors in segment reporting, footnote disclosures regarding impaired receivables and reserves, and offsetting line items in cash flow statements. SEC alleged violations of Exchange Act's requirements for internal controls.

Root Cause: Each error traced to deficiencies in internal accounting controls - company had controls for low-risk areas but failed to prioritize controls over high-risk areas like reserve accounting and segment reporting.

Penalty: Injunction + company had to remediate ICFR.

Lesson: SEC does not need fraud. Inadequate prioritization of high-impact financial controls = violation.

2. SEC vs Andeavor LLC - $20 Million Settlement - Oct 15, 2020
SEC announced $20M settlement resulting from finding of insufficient internal controls at Andeavor. SEC found company violated Exchange Act provision requiring implementation and maintenance of effective internal controls through improper initiation of share repurchase under Rule 10b5-1 plan while in possession of MNPI.

Failure: No high-impact control to prevent trading while in possession of MNPI - despite having low-impact controls for routine trades.

3. SEC Enforcement Jan 29, 2019 - Four Companies
SEC announced four settlements for failure to maintain adequate ICFR. Section 13(b)(2) requires them to maintain system of internal accounting controls. Companies had identified low-risk deficiencies but ignored material weaknesses in revenue recognition - classic failure to prioritize.

B. Cybersecurity - Failure to Prioritize Basic Security Controls

4. FTC v. Wyndham Worldwide Corp. - Landmark 2015 - 3rd Circuit Upholds FTC
Case of FTC v. Wyndham represents landmark moment in enforcement of data security standards.

Facts: Three security intrusions between April 2008 and Jan 2010. FTC alleged Wyndham stored credit card information in unencrypted, clear text format and failed to use readily available security measures, like firewalls, to segment network.

Wyndham spent on physical security and low-impact controls but failed to prioritize high-impact controls: encryption, firewall segmentation, password management.

Held: Failure to maintain reasonable and appropriate data security = unfair trade practice under Sec 5(a) FTC Act. Wyndham settled for $2.4M + 20 years audit.

This is the first case where court said prioritizing low-impact controls over high-impact = negligence.

5. ASIC v RI Advice Group Pty Ltd [2022] FCA 496 - Australia - $750K
Federal Court ruled RI Advice Group had contravened cybersecurity requirements under Corporations Act 2001. Company required to pay $750,000 in legal costs to ASIC.

Finding: Company breached licence obligations by failing to have adequate risk management system in place. Failed to prioritize controls like multi-factor authentication, email filtering, backup, despite having basic antivirus.

This is first Australian case where AFSL licensee punished solely for failure to prioritize cyber controls.

6. In re SolarWinds / SEC vs R.R. Donnelley (RRD) - 2024
SEC continues to expand enforcement to include failure to monitor managed security service providers. In settlement, SEC alleged RRD failed to maintain effective disclosure controls to inform decision-makers promptly with all relevant information concerning cyber alerts from monitoring tools.

Failure: Had SIEM alerts (high-impact) but no control to escalate them to CISO/Board. Focused on low-impact compliance tick-boxes.

7. In re Caremark / Marchand v. Barnhill (Blue Bell Creameries) - Delaware 2019
Blue Bell had food safety controls but Board failed to prioritize high-impact control: monitoring listeria in ice-cream plants. 3 deaths. Delaware Supreme Court held Board faces Caremark liability because they had no system to monitor mission-critical risk. $15M settlement, directors personally liable.

Applied to IT: If data is mission-critical, failure to prioritize encryption/access control = Blue Bell violation.

4. How Regulators Test Prioritization?

Courts and auditors now use:

1. Risk Matrix: Did you map controls to material risks? KPMG 2024 study: 44% of IPOs disclosed material weakness - most weaknesses came from controls that were never properly designed, not controls that failed while operating.
2. Material Weakness Definition: A deficiency that raises reasonable possibility that material misstatement will not be prevented or detected. Only material weaknesses must be disclosed.
3. Four Criteria for Duty of Care (California - Accellion Case):
   1. Consumer reliance on product to safeguard data
   2. Foreseeability of harm if high-impact control fails
   3. Availability of low-cost high-impact control (e.g., MFA, encryption)
   4. Failure to implement it

If you can show you had limited resources but spent on MFA/encryption/access before documentation, you are safe. If opposite, you are negligent.

5. Checklist to Avoid Liability

1. Identify Top 10 High-Impact Controls for your industry: Financial Reporting, Access Control, Encryption, Backup, Vendor Risk
2. Board Minutes: Document why you prioritized them - shows good faith under Caremark
3. CEO/CFO Certification: Before certifying, test high-impact controls within 90 days
4. Continuous Monitoring: Cyber alerts must reach decision-makers promptly