SEC Charges R.R. Donnelley & Sons Co. with Cybersecurity-Related Controls Violations

The Securities and Exchange Commission today announced that R.R. Donnelley & Sons Company (RRD), a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. “The Commission instituted this enforcement action because RRD’s controls for elevating cybersecurity incidents to its management and protecting company assets from cyberattacks were insufficient,” said Jorge G. Tenreiro, Acting Chief of the Crypto Assets and Cyber Unit. “RRD did, however, cooperate with our investigation in a meaningful way, and that is reflected in the terms of this settlement.” According to the SEC’s order, data integrity and confidentiality were critically important to RRD’s business.